Upload Kmake

deps/v8/tools/clusterfuzz/foozzie/BUILD.gn

@@ -0,0 +1,25 @@
+# Copyright 2017 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("../../../gni/v8.gni")
+
+if (v8_correctness_fuzzer) {
+  copy("v8_correctness_fuzzer_resources") {
+    sources = [
+      "v8_commands.py",
+      "v8_foozzie.py",
+      "v8_foozzie_harness_adjust.js",
+      "v8_fuzz_config.py",
+      "v8_fuzz_experiments.json",
+      "v8_fuzz_flags.json",
+      "v8_mock.js",
+      "v8_mock_archs.js",
+      "v8_mock_webassembly.js",
+      "v8_smoke_tests.js",
+      "v8_suppressions.js",
+      "v8_suppressions.py",
+    ]
+    outputs = [ "$root_out_dir/{{source_file_part}}" ]
+  }
+}

deps/v8/tools/clusterfuzz/foozzie/PRESUBMIT.py

@@ -0,0 +1,31 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import json
+
+# This line is 'magic' in that git-cl looks for it to decide whether to
+# use Python3 instead of Python2 when running the code in this file.
+USE_PYTHON3 = True
+
+
+def _RunTests(input_api, output_api):
+  return input_api.RunTests(
+      input_api.canned_checks.GetUnitTestsInDirectory(
+          input_api, output_api, '.', files_to_check=[r'.+_test\.py$'],
+          run_on_python2=False))
+
+
+def _CommonChecks(input_api, output_api):
+  """Checks common to both upload and commit."""
+  checks = [
+    _RunTests,
+  ]
+
+  return sum([check(input_api, output_api) for check in checks], [])
+
+def CheckChangeOnCommit(input_api, output_api):
+  return _CommonChecks(input_api, output_api)
+
+def CheckChangeOnUpload(input_api, output_api):
+  return _CommonChecks(input_api, output_api)

deps/v8/tools/clusterfuzz/foozzie/testdata/baseline/d8.py

@@ -0,0 +1,22 @@
+# Copyright 2016 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import sys
+
+print("""
+Some smoke-test output.
+___foozzie___smoke_test_end___
+
+1
+v8-foozzie source: name/to/a/file.js
+2
+v8-foozzie source: name/to/file.js
+3
+unknown
+""")
+
+if '--bad-flag' in sys.argv:
+  print('bad behavior')
+if '--avoid-cross-arch' in sys.argv:
+  print('Warning: This run cannot be compared across architectures.')

deps/v8/tools/clusterfuzz/foozzie/testdata/baseline/v8_build_config.json

@@ -0,0 +1 @@
+{"v8_current_cpu": "x64"}

deps/v8/tools/clusterfuzz/foozzie/testdata/build1/d8.py

@@ -0,0 +1,16 @@
+# Copyright 2016 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+print("""
+Some smoke-test output.
+___foozzie___smoke_test_end___
+
+Warning: --dont-use-this is deprecated
+1
+v8-foozzie source: name/to/a/file.js
+2
+v8-foozzie source: name/to/file.js
+3
+unknown
+""")

deps/v8/tools/clusterfuzz/foozzie/testdata/build1/v8_build_config.json

@@ -0,0 +1 @@
+{"v8_current_cpu": "x64"}

deps/v8/tools/clusterfuzz/foozzie/testdata/build2/d8.py

@@ -0,0 +1,15 @@
+# Copyright 2016 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+print("""
+Some smoke-test output.
+___foozzie___smoke_test_end___
+
+1
+v8-foozzie source: name/to/a/file.js
+2
+v8-foozzie source: name/to/file.js
+3
+not unknown
+""")

deps/v8/tools/clusterfuzz/foozzie/testdata/build2/v8_build_config.json

@@ -0,0 +1 @@
+{"v8_current_cpu": "x64"}

deps/v8/tools/clusterfuzz/foozzie/testdata/build3/d8.py

@@ -0,0 +1,24 @@
+# Copyright 2016 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import sys
+
+print("""
+Some smoke-test output.
+___foozzie___smoke_test_end___
+
+1
+v8-foozzie source: name/to/a/file.js
+2
+v8-foozzie source: name/to/file.js
+3
+unknown
+""")
+
+if '--bad-flag' in sys.argv:
+  print('bad behavior')
+if '--very-bad-flag' in sys.argv:
+  print('very bad behavior')
+if '--jitless' in sys.argv:
+  print('jitless flag passed')

deps/v8/tools/clusterfuzz/foozzie/testdata/build3/v8_build_config.json

@@ -0,0 +1 @@
+{"v8_current_cpu": "x86"}

deps/v8/tools/clusterfuzz/foozzie/testdata/build4/d8.py

@@ -0,0 +1,16 @@
+# Copyright 2024 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import sys
+
+if '--crash-the-smoke-test' in sys.argv:
+  sys.exit(73)
+
+# Simulate different output during the smoke test.
+print("""
+Different smoke-test output.
+___foozzie___smoke_test_end___
+
+Other different output.
+""")

deps/v8/tools/clusterfuzz/foozzie/testdata/build4/v8_build_config.json

@@ -0,0 +1 @@
+{"v8_current_cpu": "x64"}

deps/v8/tools/clusterfuzz/foozzie/testdata/build5/d8.py

@@ -0,0 +1,20 @@
+# Copyright 2024 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import sys
+
+print("""
+Some smoke-test output.
+___foozzie___smoke_test_end___
+
+1
+v8-foozzie source: name/to/a/file.js
+2
+v8-foozzie source: name/to/file.js
+3
+unknown
+""")
+
+if '--simulate-errors' in sys.argv:
+  sys.exit(73)

deps/v8/tools/clusterfuzz/foozzie/testdata/build5/v8_build_config.json

@@ -0,0 +1 @@
+{"v8_current_cpu": "x64"}

deps/v8/tools/clusterfuzz/foozzie/testdata/failure_output.txt

@@ -0,0 +1,47 @@
+#
+# V8 correctness failure
+# V8 correctness sources: f6
+# V8 correctness suppression: 
+#
+# CHECK
+#
+# Compared x64 with x64
+#
+# Common flags:
+--correctness-fuzzer-suppressions --expose-gc --fuzzing --allow-natives-for-differential-fuzzing --invoke-weak-callbacks --omit-quit --harmony --js-staging --wasm-staging --no-wasm-async-compilation --wasm-max-mem-pages=32767 --suppress-asm-messages --random-seed 12345
+# Baseline flags:
+--turbo-filter=~ --no-turbofan --no-sparkplug --liftoff --no-wasm-tier-up --no-maglev --flag1 --flag2=0
+# Comparison flags:
+--flag3
+#
+# Difference:
+- unknown
++ not unknown
+#
+# Source file:
+name/to/file.js
+#
+### Start of baseline output:
+
+1
+v8-foozzie source: name/to/a/file.js
+2
+v8-foozzie source: name/to/file.js
+3
+unknown
+
+
+### End of baseline output
+#
+### Start of comparison output:
+
+1
+v8-foozzie source: name/to/a/file.js
+2
+v8-foozzie source: name/to/file.js
+3
+not unknown
+
+
+### End of comparison output
+

deps/v8/tools/clusterfuzz/foozzie/testdata/failure_output_arch.txt

@@ -0,0 +1,47 @@
+#
+# V8 correctness failure
+# V8 correctness sources: f6
+# V8 correctness suppression: 
+#
+# CHECK
+#
+# Compared x64 with x64
+#
+# Common flags:
+--correctness-fuzzer-suppressions --expose-gc --fuzzing --allow-natives-for-differential-fuzzing --invoke-weak-callbacks --omit-quit --harmony --js-staging --wasm-staging --no-wasm-async-compilation --wasm-max-mem-pages=32767 --suppress-asm-messages --random-seed 12345
+# Baseline flags:
+--turbo-filter=~ --no-turbofan --no-sparkplug --liftoff --no-wasm-tier-up --no-maglev
+# Comparison flags:
+--bad-flag
+#
+# Difference:
++ bad behavior
+#
+# Source file:
+name/to/file.js
+#
+### Start of baseline output:
+
+1
+v8-foozzie source: name/to/a/file.js
+2
+v8-foozzie source: name/to/file.js
+3
+unknown
+
+
+### End of baseline output
+#
+### Start of comparison output:
+
+1
+v8-foozzie source: name/to/a/file.js
+2
+v8-foozzie source: name/to/file.js
+3
+unknown
+
+bad behavior
+
+### End of comparison output
+

deps/v8/tools/clusterfuzz/foozzie/testdata/failure_output_second.txt

@@ -0,0 +1,47 @@
+#
+# V8 correctness failure
+# V8 correctness sources: f6
+# V8 correctness suppression: 
+#
+# CHECK
+#
+# Compared x64 with ia32
+#
+# Common flags:
+--correctness-fuzzer-suppressions --expose-gc --fuzzing --allow-natives-for-differential-fuzzing --invoke-weak-callbacks --omit-quit --harmony --js-staging --wasm-staging --no-wasm-async-compilation --wasm-max-mem-pages=32767 --suppress-asm-messages --random-seed 12345
+# Baseline flags:
+--turbo-filter=~ --no-turbofan --no-sparkplug --liftoff --no-wasm-tier-up --no-maglev
+# Comparison flags:
+--very-bad-flag
+#
+# Difference:
++ very bad behavior
+#
+# Source file:
+name/to/file.js
+#
+### Start of baseline output:
+
+1
+v8-foozzie source: name/to/a/file.js
+2
+v8-foozzie source: name/to/file.js
+3
+unknown
+
+
+### End of baseline output
+#
+### Start of comparison output:
+
+1
+v8-foozzie source: name/to/a/file.js
+2
+v8-foozzie source: name/to/file.js
+3
+unknown
+
+very bad behavior
+
+### End of comparison output
+

deps/v8/tools/clusterfuzz/foozzie/testdata/fuzz-123.js

@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Empty test dummy.
+print("js-mutation: start generated test case");
+
+// For testing filters based on content.
+let b = %DontUseThis();

deps/v8/tools/clusterfuzz/foozzie/testdata/fuzz-wasm-struct-123.js

@@ -0,0 +1,7 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test dummy to check flags for particular content.
+print("js-mutation: start generated test case");
+print(%WasmStruct());

deps/v8/tools/clusterfuzz/foozzie/testdata/simulated_crash_output.txt

@@ -0,0 +1,5 @@
+#
+# V8 correctness failure
+# V8 correctness sources: 
+# V8 correctness suppression: _simulated_crash_
+

deps/v8/tools/clusterfuzz/foozzie/testdata/smoke_test_crash_output.txt

@@ -0,0 +1,5 @@
+#
+# V8 correctness failure
+# V8 correctness sources: 
+# V8 correctness suppression: _unexpected_crash_
+

deps/v8/tools/clusterfuzz/foozzie/testdata/smoke_test_output.txt

@@ -0,0 +1,35 @@
+#
+# V8 correctness failure
+# V8 correctness sources: smoke test failed
+# V8 correctness suppression: 
+#
+# CHECK
+#
+# Compared x64 with x64
+#
+# Common flags:
+--correctness-fuzzer-suppressions --expose-gc --fuzzing --allow-natives-for-differential-fuzzing --invoke-weak-callbacks --omit-quit --harmony --js-staging --wasm-staging --no-wasm-async-compilation --wasm-max-mem-pages=32767 --suppress-asm-messages --random-seed 12345
+# Baseline flags:
+--turbo-filter=~ --no-turbofan --no-sparkplug --liftoff --no-wasm-tier-up --no-maglev
+# Comparison flags:
+
+#
+# Difference:
+- Some smoke-test output.
++ Different smoke-test output.
+#
+# Source file:
+foozzie smoke test
+#
+### Start of baseline output:
+
+Some smoke-test output.
+
+### End of baseline output
+#
+### Start of comparison output:
+
+Different smoke-test output.
+
+### End of comparison output
+

deps/v8/tools/clusterfuzz/foozzie/toolchain/BUILD.gn

@@ -0,0 +1,15 @@
+# Copyright 2019 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//build/toolchain/gcc_toolchain.gni")
+
+# Fake toolchain to enable build output for an experimental build in a
+# nested build sub-directory. We toggle certain build flags when this
+# toolchain is used in v8/BUILD.gn.
+clang_toolchain("clang_x64_fuzzer_experiments") {
+  toolchain_args = {
+    current_cpu = "x64"
+    current_os = "linux"
+  }
+}

deps/v8/tools/clusterfuzz/foozzie/v8_commands.py

@@ -0,0 +1,169 @@
+# Copyright 2016 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Fork from commands.py and output.py in v8 test driver.
+
+import signal
+import subprocess
+import sys
+
+from pathlib import Path
+from threading import Event, Timer
+
+# List of default flags passed to each d8 run.
+DEFAULT_FLAGS = [
+    '--correctness-fuzzer-suppressions',
+    '--expose-gc',
+    '--fuzzing',
+    '--allow-natives-for-differential-fuzzing',
+    '--invoke-weak-callbacks',
+    '--omit-quit',
+    '--harmony',
+    '--js-staging',
+    '--wasm-staging',
+    '--no-wasm-async-compilation',
+    # Limit wasm memory to just below 2GiB, to avoid differences between 32-bit
+    # and 64-bit builds.
+    '--wasm-max-mem-pages=32767',
+    '--suppress-asm-messages',
+]
+
+BASE_PATH = Path(__file__).parent.resolve()
+
+# List of files passed to each d8 run before the testcase.
+DEFAULT_MOCK = BASE_PATH / 'v8_mock.js'
+SMOKE_TESTS = BASE_PATH / 'v8_smoke_tests.js'
+
+# Suppressions on JavaScript level for known issues.
+JS_SUPPRESSIONS = BASE_PATH / 'v8_suppressions.js'
+
+# Config-specific mock files.
+ARCH_MOCKS = BASE_PATH / 'v8_mock_archs.js'
+WEBASSEMBLY_MOCKS = BASE_PATH / 'v8_mock_webassembly.js'
+
+# Non-standard exit code only used to simulate crashes in tests.
+CRASH_CODE_FOR_TESTING = 73
+
+
+def _startup_files(options):
+  """Default files and optional config-specific mock files."""
+  files = [DEFAULT_MOCK]
+  if not options.skip_suppressions:
+    files.append(JS_SUPPRESSIONS)
+  if options.first.arch != options.second.arch:
+    files.append(ARCH_MOCKS)
+  # Mock out WebAssembly when comparing with jitless mode.
+  if '--jitless' in options.first.flags + options.second.flags:
+    files.append(WEBASSEMBLY_MOCKS)
+  # Keep the smoke tests last, right before the actual test case.
+  return files + [SMOKE_TESTS]
+
+
+class BaseException(Exception):
+  """Used to abort the comparison workflow and print the given message."""
+  def __init__(self, message):
+    self.message = message
+
+
+class PassException(BaseException):
+  """Represents an early abort making the overall run pass."""
+  pass
+
+
+class FailException(BaseException):
+  """Represents an early abort making the overall run fail."""
+  pass
+
+
+class Command(object):
+  """Represents a configuration for running V8 multiple times with certain
+  flags and files.
+  """
+  def __init__(self, options, label, executable, config_flags):
+    self.label = label
+    self.executable = executable
+    self.config_flags = config_flags
+    self.common_flags =  DEFAULT_FLAGS[:]
+    self.common_flags.extend(['--random-seed', str(options.random_seed)])
+
+    self.files = _startup_files(options)
+
+  def run(self, testcase, timeout):
+    """Run the executable with a specific testcase."""
+    raw_args = [self.executable] + self.flags + self.files + [testcase]
+    args = list(map(str, raw_args))
+    print(f'# Command line for {self.label} comparison:')
+    print(' '.join(args))
+    if self.executable.suffix == '.py':
+      # Wrap with python in tests.
+      args = [sys.executable] + args
+    return Execute(
+        args,
+        cwd=testcase.parent,
+        timeout=timeout,
+    )
+
+  @property
+  def flags(self):
+    return self.common_flags + self.config_flags
+
+  def remove_config_flag(self, remove_flag):
+    """Removes all occurences of `remove_flag` from the config flags."""
+    self.config_flags = [
+        flag for flag in self.config_flags if flag != remove_flag
+    ]
+
+
+class Output(object):
+  def __init__(self, exit_code, stdout_bytes, pid):
+    self.exit_code = exit_code
+    self.stdout_bytes = stdout_bytes
+    self.pid = pid
+
+  @property
+  def stdout(self):
+    try:
+      return self.stdout_bytes.decode('utf-8')
+    except UnicodeDecodeError:
+      return self.stdout_bytes.decode('latin-1')
+
+  def HasCrashed(self):
+    return self.exit_code < 0 or self.exit_code == CRASH_CODE_FOR_TESTING
+
+
+def Execute(args, cwd, timeout=None):
+  popen_args = [c for c in args if c != ""]
+  try:
+    process = subprocess.Popen(
+      args=popen_args,
+      stdout=subprocess.PIPE,
+      stderr=subprocess.PIPE,
+      cwd=cwd,
+    )
+  except Exception as e:
+    sys.stderr.write(f'Error executing: {popen_args}\n')
+    raise e
+
+  timeout_event = Event()
+
+  def kill_process():
+    timeout_event.set()
+    try:
+      process.kill()
+    except OSError:
+      sys.stderr.write(f'Error: Process {process.pid} already ended.\n')
+
+  timer = Timer(timeout, kill_process)
+  timer.start()
+  stdout_bytes, _ = process.communicate()
+  timer.cancel()
+
+  if timeout_event.is_set():
+    raise PassException('# V8 correctness - T-I-M-E-O-U-T')
+
+  return Output(
+      process.returncode,
+      stdout_bytes,
+      process.pid,
+  )

deps/v8/tools/clusterfuzz/foozzie/v8_foozzie.py

@@ -0,0 +1,613 @@
+#!/usr/bin/env python3
+# Copyright 2016 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+"""
+V8 correctness fuzzer launcher script.
+"""
+
+import argparse
+import hashlib
+import json
+import re
+import sys
+import traceback
+
+from collections import namedtuple
+from pathlib import Path
+
+from v8_commands import Command, FailException, PassException
+import v8_suppressions
+
+CONFIGS = dict(
+    default=[],
+    ignition=[
+        '--turbo-filter=~',
+        '--no-turbofan',
+        '--no-sparkplug',
+        '--liftoff',
+        '--no-wasm-tier-up',
+        '--no-maglev',
+    ],
+    ignition_asm=[
+        '--turbo-filter=~',
+        '--no-turbofan',
+        '--no-sparkplug',
+        '--validate-asm',
+        '--stress-validate-asm',
+        '--no-maglev',
+    ],
+    ignition_eager=[
+        '--turbo-filter=~',
+        '--no-turbofan',
+        '--no-sparkplug',
+        '--no-lazy',
+        '--no-lazy-inner-functions',
+        '--no-maglev',
+    ],
+    ignition_no_ic=[
+        '--turbo-filter=~',
+        '--no-turbofan',
+        '--no-sparkplug',
+        '--liftoff',
+        '--no-wasm-tier-up',
+        '--no-use-ic',
+        '--no-lazy-feedback-allocation',
+        '--no-maglev',
+    ],
+    ignition_turbo=[],
+    ignition_turbo_no_ic=[
+        '--no-use-ic',
+    ],
+    ignition_turbo_opt=[
+        '--always-turbofan',
+        '--no-liftoff',
+    ],
+    ignition_turbo_opt_eager=[
+        '--always-turbofan',
+        '--no-lazy',
+        '--no-lazy-inner-functions',
+    ],
+    ignition_maglev=[
+        '--maglev',
+        '--turbo-filter=~',
+        '--no-turbofan',
+    ],
+    jitless=[
+        '--jitless',
+    ],
+    slow_path=[
+        '--force-slow-path',
+    ],
+    slow_path_opt=[
+        '--always-turbofan',
+        '--force-slow-path',
+    ],
+)
+
+BASELINE_CONFIG = 'ignition'
+DEFAULT_CONFIG = 'default'
+DEFAULT_D8 = 'd8'
+
+# Return codes.
+RETURN_PASS = 0
+RETURN_FAIL = 2
+
+BASE_PATH = Path(__file__).parent.resolve()
+
+# Timeout for one d8 run.
+TEST_TIMEOUT_SEC = 3
+
+SUPPORTED_ARCHS = ['ia32', 'x64', 'arm', 'arm64']
+
+FAILURE_HEADER_TEMPLATE = """#
+# V8 correctness failure
+# V8 correctness sources: %(source_key)s
+# V8 correctness suppression: %(suppression)s
+"""
+
+# Extended output for failure case. The 'CHECK' is for the minimizer.
+DETAILS_TEMPLATE = """#
+# CHECK
+#
+# Compared %(first_config_arch)s with %(second_config_arch)s
+#
+# Common flags:
+%(common_flags)s
+# Baseline flags:
+%(first_config_flags)s
+# Comparison flags:
+%(second_config_flags)s
+#
+# Difference:
+%(difference)s%(source_file_text)s
+#
+### Start of baseline output:
+%(first_config_output)s
+### End of baseline output
+#
+### Start of comparison output:
+%(second_config_output)s
+### End of comparison output
+"""
+
+FAILURE_TEMPLATE = FAILURE_HEADER_TEMPLATE + DETAILS_TEMPLATE
+
+SOURCE_FILE_TEMPLATE = """
+#
+# Source file:
+%s"""
+
+
+FUZZ_TEST_RE = re.compile(r'.*fuzz(-\d+\.js)')
+
+# The number of hex digits used from the hash of the original source file path.
+# Keep the number small to avoid duplicate explosion.
+SOURCE_HASH_LENGTH = 2
+
+# Placeholder string if no original source file could be determined.
+ORIGINAL_SOURCE_DEFAULT = 'none'
+
+# Placeholder string for failures from crash tests. If a failure is found with
+# this signature, the matching sources should be moved to the mapping below.
+ORIGINAL_SOURCE_CRASHTESTS = 'placeholder for CrashTests'
+
+# Mapping from relative original source path (e.g. CrashTests/path/to/file.js)
+# to a string key. Map to the same key for duplicate issues. The key should
+# have more than 3 characters to not collide with other existing hashes.
+# If a symptom from a particular original source file is known to map to a
+# known failure, it can be added to this mapping. This should be done for all
+# failures from CrashTests, as those by default map to the placeholder above.
+KNOWN_FAILURES = {
+  # Foo.caller with asm.js: https://crbug.com/1042556
+  'CrashTests/4782147262545920/494.js': '.caller',
+  'CrashTests/5637524389167104/01457.js': '.caller',
+  'CrashTests/5703451898085376/02176.js': '.caller',
+  'CrashTests/4846282433495040/04342.js': '.caller',
+  'CrashTests/5712410200899584/04483.js': '.caller',
+  'v8/test/mjsunit/regress/regress-105.js': '.caller',
+  # Flaky issue that almost never repros.
+  'CrashTests/5694376231632896/1033966.js': 'flaky',
+}
+
+# Flags that crash smoke tests or produce non-deterministic output should
+# not be used.
+DISALLOWED_FLAGS = [
+    # Bails out when sorting, leading to differences in sorted output.
+    '--multi-mapped-mock-allocator',
+
+    # TODO(https://crbug.com/1393020): Changes the global object.
+    '--harmony-struct',
+
+    # Cuts off stdout earlier in some situations and might alter the behavior
+    # of neutered runtime functions.
+    '--sandbox-testing',
+
+    # Various non-deterministic stats.
+    '--dump-counters',
+    '--expose-statistics',
+    '--log',
+    '--rcs',
+]
+
+# The same as above, but prefixes that either match multiple flags or flags
+# that assign values.
+DISALLOWED_FLAG_PREFIXES = [
+    # Already passed as a default flag. That default value should not be
+    # overwritten in one of the runs.
+    '--wasm-max-mem-pages=',
+]
+
+# List pairs of flags that lead to contradictory cycles, i.e.:
+# A -> no-C and B -> C makes (A, B) contradictory.
+# No need to list other contradictions, they are omitted by the
+# --fuzzing flag).
+CONTRADICTORY_FLAGS = [
+  ('--always-turbofan', '--jitless'),
+  ('--assert-types', '--stress-concurrent-inlining'),
+  ('--assert-types', '--stress-concurrent-inlining-attach-code'),
+  ('--jitless', '--stress-concurrent-inlining'),
+  ('--jitless', '--stress-concurrent-inlining-attach-code'),
+]
+
+
+def is_disallowed_flag_prefix(flag):
+  return any(flag.startswith(prefix) for prefix in DISALLOWED_FLAG_PREFIXES)
+
+def filter_flags(flags):
+  """Drop disallowed and contradictory flags.
+
+  The precedence for contradictions is right to left, similar to the V8 test
+  framework.
+  """
+  result = []
+  flags_to_drop = set(DISALLOWED_FLAGS)
+  for flag in reversed(flags):
+    if flag in flags_to_drop or is_disallowed_flag_prefix(flag):
+      continue
+    result.append(flag)
+    for contradicting_pair in CONTRADICTORY_FLAGS:
+      if contradicting_pair[0] == flag:
+        flags_to_drop.add(contradicting_pair[1])
+      if contradicting_pair[1] == flag:
+        flags_to_drop.add(contradicting_pair[0])
+  return list(reversed(result))
+
+
+def infer_arch(d8):
+  """Infer the V8 architecture from the build configuration next to the
+  executable.
+  """
+  with (d8.parent / 'v8_build_config.json').open() as f:
+    arch = json.load(f)['v8_current_cpu']
+  arch = 'ia32' if arch == 'x86' else arch
+  assert arch in SUPPORTED_ARCHS
+  return arch
+
+
+class ExecutionArgumentsConfig(object):
+  def __init__(self, label):
+    self.label = label
+
+  def add_arguments(self, parser, default_config):
+    def add_argument(flag_template, help_template, **kwargs):
+      parser.add_argument(
+          flag_template % self.label,
+          help=help_template % self.label,
+          **kwargs)
+
+    add_argument(
+        '--%s-config',
+        '%s configuration',
+        default=default_config)
+    add_argument(
+        '--%s-config-extra-flags',
+        'additional flags passed to the %s run',
+        action='append',
+        default=[])
+    add_argument(
+        '--%s-d8',
+        'optional path to %s d8 executable, '
+        'default: bundled in the directory of this script',
+        default=DEFAULT_D8)
+
+  def make_options(self, options, default_config=None, default_d8=None):
+    def get(name):
+      return getattr(options, f'{self.label}_{name}')
+
+    config = default_config or get('config')
+    assert config in CONFIGS
+
+    d8 = Path(default_d8 or get('d8'))
+    if not d8.is_absolute():
+      d8 = BASE_PATH / d8
+    assert d8.exists()
+
+    flags = filter_flags(CONFIGS[config] + get('config_extra_flags'))
+
+    RunOptions = namedtuple('RunOptions', ['arch', 'd8', 'flags'])
+    return RunOptions(infer_arch(d8), d8, flags)
+
+
+class ExecutionConfig(object):
+  def __init__(self, options, label):
+    self.options = options
+    self.label = label
+    self.arch = getattr(options, label).arch
+    d8 = getattr(options, label).d8
+    flags = getattr(options, label).flags
+    self.command = Command(options, label, d8, flags)
+
+    # Options for a fallback configuration only exist when comparing
+    # different architectures.
+    fallback_label = label + '_fallback'
+    self.fallback = None
+    if getattr(options, fallback_label, None):
+      self.fallback = ExecutionConfig(options, fallback_label)
+
+  @property
+  def common_flags(self):
+    return self.command.common_flags
+
+  @property
+  def config_flags(self):
+    return self.command.config_flags
+
+  @property
+  def flags(self):
+    return self.command.flags
+
+  def has_config_flag(self, flag):
+    return (flag in self.config_flags or
+            self.fallback and self.fallback.has_config_flag(flag))
+
+  def remove_config_flag(self, flag):
+    self.command.remove_config_flag(flag)
+    if self.fallback:
+      self.fallback.remove_config_flag(flag)
+
+  @property
+  def is_error_simulation(self):
+    return '--simulate-errors' in self.flags
+
+
+def parse_args(args):
+  first_config_arguments = ExecutionArgumentsConfig('first')
+  second_config_arguments = ExecutionArgumentsConfig('second')
+
+  parser = argparse.ArgumentParser()
+  parser.add_argument(
+    '--random-seed', type=int, required=True,
+    help='random seed passed to both runs')
+  parser.add_argument(
+      '--skip-suppressions', default=False, action='store_true',
+      help='skip suppressions to reproduce known issues')
+  parser.add_argument(
+      '--compact', default=False, action='store_true',
+      help='deprecated: compact error reporting is the default')
+
+  # Add arguments for each run configuration.
+  first_config_arguments.add_arguments(parser, BASELINE_CONFIG)
+  second_config_arguments.add_arguments(parser, DEFAULT_CONFIG)
+
+  parser.add_argument('testcase', help='path to test case')
+  options = parser.parse_args(args)
+
+  # Ensure we have a test case.
+  options.testcase = Path(options.testcase)
+  assert options.testcase.is_file(), (
+      f"Test case {options.testcase} doesn't exist")
+
+  options.first = first_config_arguments.make_options(options)
+  options.second = second_config_arguments.make_options(options)
+  options.default = second_config_arguments.make_options(
+      options, default_config=DEFAULT_CONFIG)
+
+  # Use fallback configurations only on different architectures. In this
+  # case we are going to re-test against the first architecture.
+  if options.first.arch != options.second.arch:
+    options.second_fallback = second_config_arguments.make_options(
+        options, default_d8=options.first.d8)
+    options.default_fallback = second_config_arguments.make_options(
+        options, default_config=DEFAULT_CONFIG, default_d8=options.first.d8)
+
+  # Ensure we make a valid comparison.
+  if (options.first.d8 == options.second.d8 and
+      options.first.flags == options.second.flags):
+    parser.error('Need either executable or flag difference.')
+
+  return options
+
+
+def create_execution_configs(options):
+  """Prepare the baseline, default and secondary configuration to compare to.
+
+  The default (turbofan) takes precedence as many of the secondary configs
+  are based on the turbofan config with additional parameters.
+  """
+  return [
+      ExecutionConfig(options, 'first'),
+      ExecutionConfig(options, 'default'),
+      ExecutionConfig(options, 'second'),
+  ]
+
+
+def fail_bailout(output, ignore_by_output_fun):
+  """Print failure state and return if ignore_by_output_fun matches output."""
+  bug = (ignore_by_output_fun(output.stdout) or '').strip()
+  if bug:
+    raise FailException(FAILURE_HEADER_TEMPLATE % dict(
+        source_key='', suppression=bug))
+
+
+def format_difference(
+    first_config, second_config,
+    first_config_output, second_config_output,
+    difference, source=None):
+  # The first three entries will be parsed by clusterfuzz. Format changes
+  # will require changes on the clusterfuzz side.
+  source_file_text = SOURCE_FILE_TEMPLATE % source if source else ''
+
+  assert first_config.common_flags == second_config.common_flags
+
+  return FAILURE_TEMPLATE % dict(
+      source_file_text=source_file_text,
+      source_key=cluster_failures(source),
+      suppression='',  # We can't tie bugs to differences.
+      first_config_arch=first_config.arch,
+      second_config_arch=second_config.arch,
+      common_flags=' '.join(first_config.common_flags),
+      first_config_flags=' '.join(first_config.config_flags),
+      second_config_flags=' '.join(second_config.config_flags),
+      first_config_output=first_config_output,
+      second_config_output=second_config_output,
+      source=source,
+      difference=difference,
+  )
+
+
+def cluster_failures(source, known_failures=None):
+  """Returns a string key for clustering duplicate failures.
+
+  Args:
+    source: The original source path where the failure happened.
+    known_failures: Mapping from original source path to failure key.
+  """
+  known_failures = known_failures or KNOWN_FAILURES
+  # No source known. Typical for manually uploaded issues. This
+  # requires also manual issue creation.
+  if not source:
+    return ORIGINAL_SOURCE_DEFAULT
+  # Source is known to produce a particular failure.
+  if source in known_failures:
+    return known_failures[source]
+  # Subsume all other sources from CrashTests under one key. Otherwise
+  # failures lead to new crash tests which in turn lead to new failures.
+  if source.startswith('CrashTests'):
+    return ORIGINAL_SOURCE_CRASHTESTS
+  # Report all deviations from the smoke test as one to avoid a bug flood.
+  if source == v8_suppressions.SMOKE_TEST_SOURCE:
+    return 'smoke test failed'
+
+  # We map all remaining failures to a short hash of the original source.
+  long_key = hashlib.sha1(source.encode('utf-8')).hexdigest()
+  return long_key[:SOURCE_HASH_LENGTH]
+
+
+class RepeatedRuns(object):
+  """Helper class for storing statistical data from repeated runs."""
+  def __init__(self, test_case, timeout):
+    self.test_case = test_case
+    self.timeout = timeout
+
+    # Stores if any run has crashed or was simulated.
+    self.has_crashed = False
+    self.simulated = False
+
+  def run(self, config):
+    comparison_output = config.command.run(
+        self.test_case, timeout=self.timeout)
+    self.has_crashed = self.has_crashed or comparison_output.HasCrashed()
+    self.simulated = self.simulated or config.is_error_simulation
+    return comparison_output
+
+  @property
+  def crash_state(self):
+    return '_simulated_crash_' if self.simulated else '_unexpected_crash_'
+
+
+def run_comparisons(suppress, execution_configs, test_case, timeout):
+  """Runs different configurations and bails out on output difference.
+
+  Args:
+    suppress: The helper object for textual suppressions.
+    execution_configs: Two or more configurations to run. The first one will be
+        used as baseline to compare all others to.
+    test_case: The test case to run.
+    timeout: Timeout in seconds for one run.
+  """
+  runner = RepeatedRuns(test_case, timeout)
+
+  # Run the baseline configuration.
+  baseline_config = execution_configs[0]
+  baseline_output = runner.run(baseline_config)
+
+  # The output of the baseline run might change the shape of the remaining
+  # configurations.
+  remaining_configs = execution_configs[1:]
+  changes = suppress.adjust_configs_by_output(
+      remaining_configs, baseline_output.stdout)
+  if changes:
+    print('# Adjusted experiments based on baseline output:')
+    print('\n'.join(changes))
+
+  # Iterate over the remaining configurations, run and compare.
+  for comparison_config in remaining_configs:
+    comparison_output = runner.run(comparison_config)
+    difference, source = suppress.diff(baseline_output, comparison_output)
+
+    if difference:
+      # Only bail out due to suppressed output if there was a difference. If a
+      # suppression doesn't show up anymore in the statistics, we might want to
+      # remove it.
+      fail_bailout(baseline_output, suppress.ignore_by_output)
+      fail_bailout(comparison_output, suppress.ignore_by_output)
+
+      # Check if a difference also occurs with the fallback configuration and
+      # give it precedence. E.g. we always prefer x64 differences.
+      if comparison_config.fallback:
+        fallback_output = runner.run(comparison_config.fallback)
+        fallback_difference, fallback_source = suppress.diff(
+            baseline_output, fallback_output)
+        # Ensure also that the source doesn't differ, e.g. in case we have
+        # a real failure in the cross-arch comparison, but find the smoke
+        # tests failing in the fallback.
+        if fallback_difference and source == fallback_source:
+          fail_bailout(fallback_output, suppress.ignore_by_output)
+          comparison_config = comparison_config.fallback
+          comparison_output = fallback_output
+          difference = fallback_difference
+
+      # We print only output relevant to the source of the failure. E.g.
+      # only print smoke-test output or real failure output.
+      reduced_baseline_output = suppress.reduced_output(
+          baseline_output.stdout, source)
+      reduced_comparison_output = suppress.reduced_output(
+          comparison_output.stdout, source)
+
+      raise FailException(format_difference(
+          baseline_config, comparison_config, reduced_baseline_output,
+          reduced_comparison_output, difference, source))
+
+    # Bail out if we crash during smoke tests already or if the crash is
+    # expected based on a simulation flag.
+    if (runner.has_crashed and (
+        source == v8_suppressions.SMOKE_TEST_SOURCE or runner.simulated)):
+      # Subsume such crashes with one failure state.
+      raise FailException(FAILURE_HEADER_TEMPLATE % dict(
+          source_key='', suppression=runner.crash_state))
+
+  if runner.has_crashed:
+    # Show if a crash has happened in one of the runs, but no difference was
+    # detected. This is only for the statistics during experiments.
+    raise PassException('# V8 correctness - C-R-A-S-H')
+
+
+def main():
+  options = parse_args(sys.argv[1:])
+  suppress = v8_suppressions.get_suppression(options.skip_suppressions)
+
+  # Static bailout based on test case content or metadata.
+  with options.testcase.open(encoding='utf-8') as f:
+    content = f.read()
+
+  execution_configs = create_execution_configs(options)
+
+  # Some configs will be dropped or altered based on the testcase content.
+  changes = suppress.adjust_configs_by_content(execution_configs, content)
+  if changes:
+    print('# Adjusted flags and experiments based on the test case:')
+    print('\n'.join(changes))
+
+  # Run all configs against the fuzz test case.
+  run_comparisons(
+      suppress, execution_configs,
+      test_case=options.testcase,
+      timeout=TEST_TIMEOUT_SEC,
+  )
+
+  # TODO(machenbach): Figure out if we could also return a bug in case
+  # there's no difference, but one of the line suppressions has matched -
+  # and without the match there would be a difference.
+  print('# V8 correctness - pass')
+  return RETURN_PASS
+
+
+if __name__ == "__main__":
+  try:
+    result = main()
+  except FailException as e:
+    print(e.message)
+    result = RETURN_FAIL
+  except PassException as e:
+    print(e.message)
+    result = RETURN_PASS
+  except SystemExit:
+    # Make sure clusterfuzz reports internal errors and wrong usage.
+    # Use one label for all internal and usage errors.
+    print(FAILURE_HEADER_TEMPLATE % dict(
+        source_key='', suppression='wrong_usage'))
+    result = RETURN_FAIL
+  except MemoryError:
+    # Running out of memory happens occasionally but is not actionable.
+    print('# V8 correctness - pass')
+    result = RETURN_PASS
+  except Exception as e:
+    print(FAILURE_HEADER_TEMPLATE % dict(
+        source_key='', suppression='internal_error'))
+    print(f'# Internal error: {e}')
+    traceback.print_exc(file=sys.stdout)
+    result = RETURN_FAIL
+
+  sys.exit(result)

deps/v8/tools/clusterfuzz/foozzie/v8_foozzie_harness_adjust.js

@@ -0,0 +1,100 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Extensions to mjsunit and other test harnesses added between harness and
+// fuzzing code.
+
+try {
+  // Scope for utility functions.
+  (function() {
+    // Same as in mjsunit.js.
+    function classOf(object) {
+      // Argument must not be null or undefined.
+      var string = Object.prototype.toString.call(object);
+      // String has format [object <ClassName>].
+      return string.substring(8, string.length - 1);
+    }
+
+    // Override prettyPrinted with a version that also recusively prints object
+    // properties (with a depth of 3).
+    let origPrettyPrinted = prettyPrinted;
+    prettyPrinted = function prettyPrinted(value, depth=3) {
+      if (depth == 0) {
+        return "...";
+      }
+      switch (typeof value) {
+        case "object":
+          if (value === null) return "null";
+          var objectClass = classOf(value);
+          switch (objectClass) {
+            case "Object":
+              var name = value.constructor.name;
+              if (!name)
+                name = "Object";
+              return name + "{" + Object.keys(value).map(function(key, index) {
+                return (
+                    prettyPrinted(key, depth - 1) +
+                    ": " +
+                    prettyPrinted(value[key], depth - 1)
+                );
+              }).join(",")  + "}";
+          }
+      }
+      // Fall through to original version for all other types.
+      return origPrettyPrinted(value);
+    }
+
+    // We're not interested in stack traces.
+    MjsUnitAssertionError = function MjsUnitAssertionError(message) {}
+    MjsUnitAssertionError.prototype.toString = function () { return ""; };
+
+    // Do more printing in assertions for more correctness coverage.
+    failWithMessage = function failWithMessage(message) {
+      print(prettyPrinted(message))
+    }
+
+    assertSame = function assertSame(expected, found, name_opt) {
+      print(prettyPrinted(found));
+    }
+
+    assertNotSame = function assertNotSame(expected, found, name_opt) {
+      print(prettyPrinted(found));
+    }
+
+    assertEquals = function assertEquals(expected, found, name_opt) {
+      print(prettyPrinted(found));
+    }
+
+    assertNotEquals = function assertNotEquals(expected, found, name_opt) {
+      print(prettyPrinted(found));
+    }
+
+    assertNull = function assertNull(value, name_opt) {
+      print(prettyPrinted(value));
+    }
+
+    assertNotNull = function assertNotNull(value, name_opt) {
+      print(prettyPrinted(value));
+    }
+
+    // Suppress optimization status as it leads to false positives.
+    assertUnoptimized = function assertUnoptimized() {}
+
+    assertOptimized = function assertOptimized() {}
+
+    isNeverOptimize = function isNeverOptimize() {}
+
+    isAlwaysOptimize = function isAlwaysOptimize() {}
+
+    isInterpreted = function isInterpreted() {}
+
+    isBaseline = function isBaseline() {}
+
+    isUnoptimized = function isUnoptimized() {}
+
+    isOptimized = function isOptimized() {}
+
+    isTurboFanned = function isTurboFanned() {}
+  })();
+} catch(e) { }

deps/v8/tools/clusterfuzz/foozzie/v8_foozzie_test.py

@@ -0,0 +1,674 @@
+#!/usr/bin/env python3
+# Copyright 2016 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import os
+import random
+import re
+import subprocess
+import sys
+import textwrap
+import unittest
+import unittest.mock
+
+from pathlib import Path
+
+import v8_commands
+import v8_foozzie
+import v8_fuzz_config
+import v8_suppressions
+
+BASE_DIR = Path(__file__).parent.resolve()
+FOOZZIE = BASE_DIR / 'v8_foozzie.py'
+TEST_DATA = BASE_DIR / 'testdata'
+
+KNOWN_BUILDS = [
+  'd8',
+  'clang_x86/d8',
+  'clang_x86_v8_arm/d8',
+  'clang_x64_v8_arm64/d8',
+  'clang_x64_fuzzer_experiments/d8',
+]
+
+
+def output(stdout, is_crash):
+  exit_code = -1 if is_crash else 0
+  return v8_commands.Output(
+      exit_code=exit_code, stdout_bytes=stdout.encode('utf-8'), pid=0)
+
+
+class ConfigTest(unittest.TestCase):
+  def testExperiments(self):
+    """Test integrity of probabilities and configs."""
+    CONFIGS = v8_foozzie.CONFIGS
+    EXPERIMENTS = v8_fuzz_config.FOOZZIE_EXPERIMENTS
+    FLAGS = v8_fuzz_config.ADDITIONAL_FLAGS
+    # Probabilities add up to 100%.
+    first_is_int = lambda x: type(x[0]) == int
+    assert all(map(first_is_int, EXPERIMENTS))
+    assert sum(x[0] for x in EXPERIMENTS) == 100
+    # Configs used in experiments are defined.
+    assert all(map(lambda x: x[1] in CONFIGS, EXPERIMENTS))
+    assert all(map(lambda x: x[2] in CONFIGS, EXPERIMENTS))
+    # The last config item points to a known build configuration.
+    assert all(map(lambda x: x[3] in KNOWN_BUILDS, EXPERIMENTS))
+    # All flags have a probability.
+    first_is_float = lambda x: type(x[0]) == float
+    assert all(map(first_is_float, FLAGS))
+    first_between_0_and_1 = lambda x: x[0] > 0 and x[0] < 1
+    assert all(map(first_between_0_and_1, FLAGS))
+    # Test consistent flags.
+    second_is_string = lambda x: isinstance(x[1], str)
+    assert all(map(second_is_string, FLAGS))
+    # We allow spaces to separate more flags. We don't allow spaces in the flag
+    # value.
+    is_flag = lambda x: x.startswith('--')
+    all_parts_are_flags = lambda x: all(map(is_flag, x[1].split()))
+    assert all(map(all_parts_are_flags, FLAGS))
+
+  def testConfig(self):
+    """Smoke test how to choose experiments."""
+    config = v8_fuzz_config.Config('foo', random.Random(42))
+    experiments = [
+      [25, 'ignition', 'jitless', 'd8'],
+      [75, 'ignition', 'ignition', 'clang_x86/d8'],
+    ]
+    flags = [
+      [0.1, '--flag'],
+      [0.3, '--baz'],
+      [0.3, '--foo --bar'],
+    ]
+    self.assertEqual(
+        [
+          '--first-config=ignition',
+          '--second-config=jitless',
+          '--second-d8=d8',
+          '--second-config-extra-flags=--baz',
+          '--second-config-extra-flags=--foo',
+          '--second-config-extra-flags=--bar',
+        ],
+        config.choose_foozzie_flags(experiments, flags),
+    )
+    self.assertEqual(
+        [
+          '--first-config=ignition',
+          '--second-config=jitless',
+          '--second-d8=d8',
+        ],
+        config.choose_foozzie_flags(experiments, flags),
+    )
+
+
+class UnitTest(unittest.TestCase):
+  def testCluster(self):
+    crash_test_example_path = 'CrashTests/path/to/file.js'
+    self.assertEqual(
+        v8_foozzie.ORIGINAL_SOURCE_DEFAULT,
+        v8_foozzie.cluster_failures(''))
+    self.assertEqual(
+        v8_foozzie.ORIGINAL_SOURCE_CRASHTESTS,
+        v8_foozzie.cluster_failures(crash_test_example_path))
+    self.assertEqual(
+        '_o_O_',
+        v8_foozzie.cluster_failures(
+            crash_test_example_path,
+            known_failures={crash_test_example_path: '_o_O_'}))
+    self.assertEqual(
+        '98',
+        v8_foozzie.cluster_failures('v8/test/mjsunit/apply.js'))
+
+  def testDiff(self):
+    def diff_fun(one, two, skip=False):
+      suppress = v8_suppressions.get_suppression(skip)
+      return suppress.diff_lines(one.splitlines(), two.splitlines())
+
+    smoke = v8_suppressions.SMOKE_TEST_SOURCE
+
+    one = ''
+    two = ''
+    diff = None, smoke
+    self.assertEqual(diff, diff_fun(one, two))
+
+    one = 'a \n  b\nc();'
+    two = 'a \n  b\nc();'
+    diff = None, smoke
+    self.assertEqual(diff, diff_fun(one, two))
+
+    one = """
+Still equal
+Extra line
+"""
+    two = """
+Still equal
+"""
+    diff = '- Extra line', smoke
+    self.assertEqual(diff, diff_fun(one, two))
+
+    one = """
+Still equal
+"""
+    two = """
+Still equal
+Extra line
+"""
+    diff = '+ Extra line', smoke
+    self.assertEqual(diff, diff_fun(one, two))
+
+    one = """
+undefined
+somefile.js: TypeError: undefined is not a constructor
+"""
+    two = """
+undefined
+otherfile.js: TypeError: undefined is not a constructor
+"""
+    diff = """- somefile.js: TypeError: undefined is not a constructor
++ otherfile.js: TypeError: undefined is not a constructor""", smoke
+    self.assertEqual(diff, diff_fun(one, two))
+
+  def testOutputCapping(self):
+    def check(stdout1, stdout2, is_crash1, is_crash2, capped_lines1,
+              capped_lines2):
+      output1 = output(stdout1, is_crash1)
+      output2 = output(stdout2, is_crash2)
+      self.assertEqual(
+          (capped_lines1.encode('utf-8'), capped_lines2.encode('utf-8')),
+          v8_suppressions.get_output_capped(output1, output2))
+
+    # No capping, already equal.
+    check('1\n2', '1\n2', True, True, '1\n2', '1\n2')
+    # No crash, no capping.
+    check('1\n2', '1\n2\n3', False, False, '1\n2', '1\n2\n3')
+    check('1\n2\n3', '1\n2', False, False, '1\n2\n3', '1\n2')
+    # Cap smallest if all runs crash.
+    check('1\n2', '1\n2\n3', True, True, '1\n2', '1\n2')
+    check('1\n2\n3', '1\n2', True, True, '1\n2', '1\n2')
+    check('1\n2', '1\n23', True, True, '1\n2', '1\n2')
+    check('1\n23', '1\n2', True, True, '1\n2', '1\n2')
+    # Cap the non-crashy run.
+    check('1\n2\n3', '1\n2', False, True, '1\n2', '1\n2')
+    check('1\n2', '1\n2\n3', True, False, '1\n2', '1\n2')
+    check('1\n23', '1\n2', False, True, '1\n2', '1\n2')
+    check('1\n2', '1\n23', True, False, '1\n2', '1\n2')
+    # The crashy run has more output.
+    check('1\n2\n3', '1\n2', True, False, '1\n2\n3', '1\n2')
+    check('1\n2', '1\n2\n3', False, True, '1\n2', '1\n2\n3')
+    check('1\n23', '1\n2', True, False, '1\n23', '1\n2')
+    check('1\n2', '1\n23', False, True, '1\n2', '1\n23')
+    # Keep output difference when capping.
+    check('1\n2', '3\n4\n5', True, True, '1\n2', '3\n4')
+    check('1\n2\n3', '4\n5', True, True, '1\n2', '4\n5')
+    check('12', '345', True, True, '12', '34')
+    check('123', '45', True, True, '12', '45')
+
+  @unittest.mock.patch(
+      'v8_suppressions.IGNORE_LINES',
+      [re.compile('^ign1.*\n'.encode('utf-8'), re.M),
+       re.compile('^ign2.*\n'.encode('utf-8'), re.M)])
+  def testIgnoredLines(self):
+    def check(stdout1, stdout2, is_crash1, is_crash2, diff):
+      output1 = output(stdout1, is_crash1)
+      output2 = output(stdout2, is_crash2)
+      suppress = v8_suppressions.get_suppression()
+      self.assertEqual(
+          (diff, v8_suppressions.SMOKE_TEST_SOURCE),
+          suppress.diff(output1, output2))
+
+    # One run has lines to ignore, the other crashes.
+    check('ign1X\n111\nign2X\n222\n333', '111\n22', False, True, None)
+    check('111\n22', 'ign1X\n111\nign2X\n222\n333', True, False, None)
+
+    # Ignored lines in both runs at different positions.
+    check('ign1X\n111\n222\n333', '111\nign2X\n22', False, True, None)
+    check('111\nign2X\n22', 'ign1X\n111\n222\n333', True, False, None)
+
+    # Ignored lines at different positions, no crash.
+    check('ign2X\n111\n\n222', 'ign1X\n111\nign1X\n\n222', False, False, None)
+    check('ign1X\n111\nign1X\n\n222', 'ign2X\n111\n\n222', False, False, None)
+
+    # Ignored lines and a difference, no crash.
+    check('1\n2\nign2\n3', 'ign1X\n1\nign1\n2', False, False, '- 3')
+    check('ign1X\n1\nign1\n2', '1\n2\nign2\n3', False, False, '+ 3')
+
+    # Ignored lines, a difference and a crash.
+    check('\n1\n3\nign1X\n4', '\nign2\n1\nign1\n2', False, True, '- 3\n+ 2')
+    check('\nign2\n1\nign1\n2', '\n1\n3\nign1X\n4', True, False, '- 2\n+ 3')
+
+  def testReduceOutput(self):
+    suppress = v8_suppressions.get_suppression()
+    proper_test_output = textwrap.dedent(f"""\
+      Smoke-test output.
+      {v8_suppressions.SMOKE_TEST_END_TOKEN}
+      Real-test output.
+      Some more.""")
+
+    # The source is some test. Don't show smoke-test output.
+    result = suppress.reduced_output(proper_test_output, 'some/file')
+    expected = textwrap.dedent(f"""\
+      Real-test output.
+      Some more.""")
+    self.assertEqual(expected, result)
+
+    # The source is the smoke test. Only show smoke-test output.
+    result = suppress.reduced_output(
+        proper_test_output, v8_suppressions.SMOKE_TEST_SOURCE)
+    self.assertEqual('Smoke-test output.\n', result)
+
+    # Smoke-test output is not properly wrapped. Check that we print
+    # everything.
+    invalid_test_output = textwrap.dedent(f"""\
+      Smoke-test output.
+      Real-test output.
+      Some more.""")
+    result = suppress.reduced_output(invalid_test_output, 'some/file')
+    self.assertEqual(invalid_test_output, result)
+
+  @unittest.mock.patch('v8_foozzie.DISALLOWED_FLAGS', ['A'])
+  @unittest.mock.patch('v8_foozzie.CONTRADICTORY_FLAGS',
+                       [('B', 'C'), ('B', 'D')])
+  def testFilterFlags(self):
+    def check(input_flags, expected):
+      self.assertEqual(expected, v8_foozzie.filter_flags(input_flags))
+
+    check([], [])
+    check(['A'], [])
+    check(['D', 'A'], ['D'])
+    check(['A', 'D'], ['D'])
+    check(['C', 'D'], ['C', 'D'])
+    check(['E', 'C', 'D', 'F'], ['E', 'C', 'D', 'F'])
+    check(['B', 'D'], ['D'])
+    check(['D', 'B'], ['B'])
+    check(['C', 'B', 'D'], ['C', 'D'])
+    check(['E', 'C', 'A', 'F', 'B', 'G', 'D'], ['E', 'C', 'F', 'G', 'D'])
+
+  @unittest.mock.patch('v8_foozzie.DISALLOWED_FLAG_PREFIXES', ['A', 'B='])
+  def testFilterFlagPrefixes(self):
+    def check(input_flags, expected):
+      self.assertEqual(expected, v8_foozzie.filter_flags(input_flags))
+
+    check([], [])
+    check(['A'], [])
+    check(['D', 'A1'], ['D'])
+    check(['A1', 'D'], ['D'])
+    check(['B=42', 'D'], ['D'])
+    check(['D', 'B=42'], ['D'])
+    check(['A', 'B', 'C=42', 'D', 'B=-1'], ['B', 'C=42', 'D'])
+
+  def _test_content(self, filename):
+    with (TEST_DATA / filename).open() as f:
+      return f.read()
+
+  def _create_execution_configs(self, *extra_flags, **kwargs):
+    """Create three execution configs as in production with a fake config
+    called `special`.
+    """
+    # If we need the configs to be cross-arch with same-arch fallbacks,
+    # we use build3 (x86) otherwise we compare with build1 (x64).
+    build = 'build3' if kwargs.pop('cross_arch', True) else 'build1'
+    argv = create_test_cmd_line(build, 'special', 'fuzz-123.js',
+                                *extra_flags)
+    options = v8_foozzie.parse_args(argv[2:])
+    return v8_foozzie.create_execution_configs(options)
+
+  @unittest.mock.patch('v8_suppressions.DROP_FLAGS_ON_CONTENT',
+                       [('--bat', r'\%DontUseThat\(|\%DontUseThis\(')])
+  @unittest.mock.patch(
+      'v8_foozzie.CONFIGS', {
+          'ignition': ['--foo', '--baz'],
+          'default': ['--bar', '--baz'],
+          'special': ['--bat'],
+      })
+  def testAdjustConfigsByContent_Matches1(self):
+    suppress = v8_suppressions.get_suppression()
+    content = self._test_content('fuzz-123.js')
+    configs = self._create_execution_configs()
+    logs = suppress.adjust_configs_by_content(configs, content)
+    self.assertEqual(
+        ['Dropped second config using --bat based on content rule.'], logs)
+    self.assertEqual(2, len(configs))
+    self.assertEqual(['--foo', '--baz'], configs[0].config_flags)
+    self.assertEqual(['--bar', '--baz'], configs[1].config_flags)
+
+    configs = self._create_execution_configs('--first-config-extra-flags=--bat')
+    logs = suppress.adjust_configs_by_content(configs, content)
+    expected_logs = [
+        'Dropped --bat from first config based on content rule.',
+        'Dropped second config using --bat based on content rule.',
+    ]
+    self.assertEqual(expected_logs, logs)
+    self.assertEqual(2, len(configs))
+    self.assertEqual(['--foo', '--baz'], configs[0].config_flags)
+    self.assertEqual(['--bar', '--baz'], configs[1].config_flags)
+
+  @unittest.mock.patch('v8_suppressions.DROP_FLAGS_ON_CONTENT',
+                       [('--baz', r'\%DontUseThat\(|\%DontUseThis\(')])
+  @unittest.mock.patch(
+      'v8_foozzie.CONFIGS', {
+          'ignition': ['--foo', '--baz'],
+          'default': ['--bar', '--baz'],
+          'special': ['--bat'],
+      })
+  def testAdjustConfigsByContent_Matches2(self):
+    suppress = v8_suppressions.get_suppression()
+    content = self._test_content('fuzz-123.js')
+    configs = self._create_execution_configs()
+    logs = suppress.adjust_configs_by_content(configs, content)
+    expected_logs = [
+        'Dropped --baz from first config based on content rule.',
+        'Dropped --baz from default config based on content rule.',
+    ]
+    self.assertEqual(expected_logs, logs)
+    self.assertEqual(3, len(configs))
+    self.assertEqual(['--foo'], configs[0].config_flags)
+    self.assertEqual(['--bar'], configs[1].config_flags)
+    self.assertEqual(['--bar'], configs[1].fallback.config_flags)
+    self.assertEqual(['--bat'], configs[2].config_flags)
+    self.assertEqual(['--bat'], configs[2].fallback.config_flags)
+
+    configs = self._create_execution_configs(
+        '--second-config-extra-flags=--baz')
+    logs = suppress.adjust_configs_by_content(configs, content)
+    expected_logs = [
+        'Dropped --baz from first config based on content rule.',
+        'Dropped --baz from default config based on content rule.',
+        'Dropped second config using --baz based on content rule.',
+    ]
+    self.assertEqual(expected_logs, logs)
+    self.assertEqual(2, len(configs))
+    self.assertEqual(['--foo'], configs[0].config_flags)
+    self.assertEqual(['--bar'], configs[1].config_flags)
+    self.assertEqual(['--bar'], configs[1].fallback.config_flags)
+
+  @unittest.mock.patch('v8_suppressions.DROP_FLAGS_ON_CONTENT',
+                       [('--baz', r'\%UnusedFun\(')])
+  @unittest.mock.patch('v8_foozzie.CONFIGS', {
+      'ignition': ['--foo', '--baz'],
+      'default': ['--bar'],
+      'special': ['--bat'],
+  })
+  def testAdjustConfigsByContent_DoesntMatch(self):
+    suppress = v8_suppressions.get_suppression()
+    content = self._test_content('fuzz-123.js')
+    configs = self._create_execution_configs(
+        '--second-config-extra-flags=--baz')
+    logs = suppress.adjust_configs_by_content(configs, content)
+    self.assertEqual([], logs)
+    self.assertEqual(3, len(configs))
+    self.assertEqual(['--foo', '--baz'], configs[0].config_flags)
+    self.assertEqual(['--bar', '--baz'], configs[1].config_flags)
+    self.assertEqual(['--bar', '--baz'], configs[1].fallback.config_flags)
+    self.assertEqual(['--bat', '--baz'], configs[2].config_flags)
+    self.assertEqual(['--bat', '--baz'], configs[2].fallback.config_flags)
+
+  @unittest.mock.patch(
+      'v8_foozzie.CONFIGS', {
+          'ignition': ['--foo'],
+          'default': [],
+          'special': ['--bar'],
+      })
+  def testAdjustConfigsByOutput_Matches(self):
+    """Test scenarios where the directive to avoid cross-arch comparison is in
+    the output.
+    """
+    suppress = v8_suppressions.get_suppression()
+    matching_output = textwrap.dedent("""\
+      Some lines...
+      Indentation doesn't matter.
+      Warning: This run cannot be compared across architectures.
+      That's it.""")
+
+    # Scenario 1: We have a match, but the comparisons are in the same
+    # architecture. So there's nothing to do.
+    configs = self._create_execution_configs(cross_arch=False)
+    baseline_config = configs[0]
+    remaining_configs = configs[1:]
+    logs = suppress.adjust_configs_by_output(
+        remaining_configs, matching_output)
+    self.assertEqual([], logs)
+    self.assertEqual(2, len(remaining_configs))
+    for config in remaining_configs:
+      self.assertEqual(baseline_config.arch, config.arch)
+      self.assertIsNone(config.fallback)
+
+    # Scenario 2: We have a match and compare cross-arch. Ensure the
+    # adjustments turns this into a same-arch comparison.
+    configs = self._create_execution_configs()
+    baseline_config = configs[0]
+    remaining_configs = configs[1:]
+    logs = suppress.adjust_configs_by_output(
+        remaining_configs, matching_output)
+    expected_logs = [
+        'Running the default config on the same architecture.',
+        'Running the second config on the same architecture.'
+    ]
+    self.assertEqual(expected_logs, logs)
+    self.assertEqual(2, len(remaining_configs))
+    for config in remaining_configs:
+      self.assertEqual(baseline_config.arch, config.arch)
+      self.assertIsNone(config.fallback)
+
+  @unittest.mock.patch(
+      'v8_foozzie.CONFIGS', {
+          'ignition': ['--foo'],
+          'default': [],
+          'special': ['--bar'],
+      })
+  def testAdjustConfigsByOutput_DoesntMatch(self):
+    """Test that cross-arch comparisons stay untouched if the directive
+    from above is not in the output.
+    """
+    suppress = v8_suppressions.get_suppression()
+    non_matching_output = textwrap.dedent("""\
+      Some lines...
+      Indentation doesn't matter.
+      That's it.""")
+
+    configs = self._create_execution_configs(cross_arch=True)
+    baseline_config = configs[0]
+    remaining_configs = configs[1:]
+    logs = suppress.adjust_configs_by_output(
+        remaining_configs, non_matching_output)
+    self.assertEqual([], logs)
+    self.assertEqual(2, len(remaining_configs))
+    for config in remaining_configs:
+      self.assertNotEqual(baseline_config.arch, config.arch)
+      self.assertEqual(baseline_config.arch, config.fallback.arch)
+
+
+def cut_verbose_output(stdout, n_comp):
+  # This removes the first lines containing d8 commands of `n_comp` comparison
+  # runs.
+  return '\n'.join(stdout.split('\n')[n_comp * 2:])
+
+
+def create_test_cmd_line(second_d8_dir, second_config, filename, *extra_flags):
+  return list(
+      map(str, [
+          sys.executable,
+          FOOZZIE,
+          '--random-seed',
+          '12345',
+          '--first-d8',
+          TEST_DATA / 'baseline' / 'd8.py',
+          '--second-d8',
+          TEST_DATA / second_d8_dir / 'd8.py',
+          '--first-config',
+          'ignition',
+          '--second-config',
+          second_config,
+          TEST_DATA / filename,
+      ] + list(extra_flags)))
+
+
+def run_foozzie(second_d8_dir, *extra_flags, **kwargs):
+  filename = kwargs.pop('filename', 'fuzz-123.js')
+  second_config = kwargs.pop('second_config', 'ignition_turbo')
+  cmd = create_test_cmd_line(second_d8_dir, second_config, filename,
+                             *extra_flags)
+  return subprocess.check_output(cmd, text=True, **kwargs)
+
+
+class SystemTest(unittest.TestCase):
+  """This tests the whole correctness-fuzzing harness with fake build
+  artifacts.
+
+  Overview of fakes:
+    baseline: Example foozzie output.
+    build1: No difference to baseline but ignored lines.
+    build2: Output difference causing the script to fail.
+    build3: As build1 but with an architecture difference as well.
+  """
+
+  def assert_expected(self, file_name, expected):
+    if os.environ.get('GENERATE'):
+      with (TEST_DATA / file_name).open('w') as f:
+        f.write(expected)
+    with (TEST_DATA / file_name).open() as f:
+      self.assertEqual(f.read(), expected)
+
+  def testPass(self):
+    stdout = run_foozzie('build1')
+    self.assertEqual('# V8 correctness - pass\n',
+                     cut_verbose_output(stdout, 3))
+    # Default comparison includes suppressions.
+    self.assertIn('v8_suppressions.js', stdout)
+    # Default comparison doesn't include any specific mock files.
+    self.assertNotIn('v8_mock_archs.js', stdout)
+    self.assertNotIn('v8_mock_webassembly.js', stdout)
+
+  def _testDifferentOutputFail(self, expected_path, *args):
+    with self.assertRaises(subprocess.CalledProcessError) as ctx:
+      run_foozzie('build2',
+                  '--first-config-extra-flags=--flag1',
+                  '--first-config-extra-flags=--flag2=0',
+                  '--second-config-extra-flags=--flag3', *args)
+    e = ctx.exception
+    self.assertEqual(v8_foozzie.RETURN_FAIL, e.returncode)
+    self.assert_expected(expected_path, cut_verbose_output(e.output, 2))
+
+  def testDifferentOutputFail(self):
+    self._testDifferentOutputFail('failure_output.txt')
+
+  def testSmokeTest_Fails(self):
+    with self.assertRaises(subprocess.CalledProcessError) as ctx:
+      run_foozzie('build4')
+    e = ctx.exception
+    self.assertEqual(v8_foozzie.RETURN_FAIL, e.returncode)
+    self.assert_expected(
+        'smoke_test_output.txt', cut_verbose_output(e.output, 2))
+
+  def testSmokeTest_Crashes(self):
+    with self.assertRaises(subprocess.CalledProcessError) as ctx:
+      run_foozzie('build4',
+                  '--second-config-extra-flags=--crash-the-smoke-test')
+    e = ctx.exception
+    self.assertEqual(v8_foozzie.RETURN_FAIL, e.returncode)
+    self.assert_expected(
+        'smoke_test_crash_output.txt', cut_verbose_output(e.output, 2))
+
+  def testSimulatedCrash(self):
+    with self.assertRaises(subprocess.CalledProcessError) as ctx:
+      run_foozzie('build5', '--second-config-extra-flags=--simulate-errors')
+    e = ctx.exception
+    self.assertEqual(v8_foozzie.RETURN_FAIL, e.returncode)
+    self.assert_expected(
+        'simulated_crash_output.txt', cut_verbose_output(e.output, 2))
+
+  def testDifferentArch(self):
+    """Test that the architecture-specific mocks are passed to both runs when
+    we use executables with different architectures.
+    """
+    # Build 3 simulates x86, while the baseline is x64.
+    stdout = run_foozzie('build3')
+    lines = stdout.split('\n')
+    # TODO(machenbach): Don't depend on the command-lines being printed in
+    # particular lines.
+    self.assertIn('v8_mock_archs.js', lines[1])
+    self.assertIn('v8_mock_archs.js', lines[3])
+
+  def testDifferentArchFailFirst(self):
+    """Test that we re-test against x64. This tests the path that also fails
+    on x64 and then reports the error as x64.
+    """
+    # Build 3 simulates x86 and produces a difference on --bad-flag, but
+    # the baseline build shows the same difference when --bad-flag is passed.
+    with self.assertRaises(subprocess.CalledProcessError) as ctx:
+      run_foozzie('build3', '--second-config-extra-flags=--bad-flag')
+    e = ctx.exception
+    self.assertEqual(v8_foozzie.RETURN_FAIL, e.returncode)
+    self.assert_expected(
+        'failure_output_arch.txt', cut_verbose_output(e.output, 3))
+
+  def testDifferentArchFailSecond(self):
+    """As above, but we test the path that only fails in the second (ia32)
+    run and not with x64 and then reports the error as ia32.
+    """
+    # Build 3 simulates x86 and produces a difference on --very-bad-flag,
+    # which the baseline build doesn't.
+    with self.assertRaises(subprocess.CalledProcessError) as ctx:
+      run_foozzie('build3', '--second-config-extra-flags=--very-bad-flag')
+    e = ctx.exception
+    self.assertEqual(v8_foozzie.RETURN_FAIL, e.returncode)
+    self.assert_expected(
+        'failure_output_second.txt', cut_verbose_output(e.output, 3))
+
+  def testJitless(self):
+    """Test that webassembly is mocked out when comparing with jitless."""
+    stdout = run_foozzie(
+        'build1', second_config='jitless')
+    lines = stdout.split('\n')
+    # TODO(machenbach): Don't depend on the command-lines being printed in
+    # particular lines.
+    self.assertIn('v8_mock_webassembly.js', lines[1])
+    self.assertIn('v8_mock_webassembly.js', lines[3])
+
+  def testJitlessAndWasmStruct_FlagPassed(self):
+    """We keep passing the --jitless flag when no content rule matches.
+
+    The flag passed to one run of build3 causes an output difference.
+    """
+    with self.assertRaises(subprocess.CalledProcessError) as ctx:
+      run_foozzie('build3', second_config='jitless')
+    self.assertIn('jitless flag passed', ctx.exception.stdout)
+    self.assertNotIn('Adjusted flags and experiments based on the test case',
+                     ctx.exception.stdout)
+
+  def testJitlessAndWasmStruct_FlagDropped(self):
+    """We drop the --jitless flag when the content rule matches."""
+    stdout = run_foozzie(
+        'build3',
+        second_config='jitless',
+        filename='fuzz-wasm-struct-123.js')
+    self.assertIn('Adjusted flags and experiments based on the test case',
+                  stdout)
+    self.assertIn(
+        'Dropped second config using --jitless based on content rule.', stdout)
+
+  def testAvoidCrossArchComparison(self):
+    """We turn a cross-arch into a same-arch comparison if a directive is in
+    the baseline output.
+    """
+    stdout = run_foozzie(
+        'build3',
+        '--first-config-extra-flags=--avoid-cross-arch',
+        second_config='ignition_turbo_opt',
+        filename='fuzz-123.js')
+
+    self.assertIn('# Adjusted experiments based on baseline output', stdout)
+    self.assertIn(
+        'Running the default config on the same architecture.', stdout)
+    self.assertIn(
+        'Running the second config on the same architecture.', stdout)
+
+  def testSkipSuppressions(self):
+    """Test that the suppressions file is not passed when skipping
+    suppressions.
+    """
+    # Compare baseline with baseline. This passes as there is no difference.
+    stdout = run_foozzie('baseline', '--skip-suppressions')
+    self.assertNotIn('v8_suppressions.js', stdout)
+
+
+if __name__ == '__main__':
+  unittest.main()

deps/v8/tools/clusterfuzz/foozzie/v8_fuzz_config.py

@@ -0,0 +1,65 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import json
+import random
+
+from pathlib import Path
+
+THIS_DIR = Path(__file__).parent.resolve()
+
+# List of configuration experiments for correctness fuzzing.
+# List of <probability>, <1st config name>, <2nd config name>, <2nd d8>.
+# Probabilities must add up to 100.
+with (THIS_DIR / 'v8_fuzz_experiments.json').open() as f:
+  FOOZZIE_EXPERIMENTS = json.load(f)
+
+# Additional flag experiments. List of tuples like
+# (<likelihood to use flags in [0,1)>, <flag>).
+with (THIS_DIR / 'v8_fuzz_flags.json').open() as f:
+  ADDITIONAL_FLAGS = json.load(f)
+
+
+class Config(object):
+  def __init__(self, name, rng=None):
+    """
+    Args:
+      name: Name of the used fuzzer.
+      rng: Random number generator for generating experiments.
+      random_seed: Random-seed used for d8 throughout one fuzz session.
+    """
+    self.name = name
+    self.rng = rng or random.Random()
+
+  def choose_foozzie_flags(self, foozzie_experiments=None, additional_flags=None):
+    """Randomly chooses a configuration from FOOZZIE_EXPERIMENTS.
+
+    Args:
+      foozzie_experiments: Override experiment config for testing.
+      additional_flags: Override additional flags for testing.
+
+    Returns: List of flags to pass to v8_foozzie.py fuzz harness.
+    """
+    foozzie_experiments = foozzie_experiments or FOOZZIE_EXPERIMENTS
+    additional_flags = additional_flags or ADDITIONAL_FLAGS
+
+    # Add additional flags to second config based on experiment percentages.
+    extra_flags = []
+    for p, flags in additional_flags:
+      if self.rng.random() < p:
+        for flag in flags.split():
+          extra_flags.append(f'--second-config-extra-flags={flag}')
+
+    # Calculate flags determining the experiment.
+    acc = 0
+    threshold = self.rng.random() * 100
+    for prob, first_config, second_config, second_d8 in foozzie_experiments:
+      acc += prob
+      if acc > threshold:
+        return [
+            f'--first-config={first_config}',
+            f'--second-config={second_config}',
+            f'--second-d8={second_d8}',
+        ] + extra_flags
+    assert False

deps/v8/tools/clusterfuzz/foozzie/v8_fuzz_experiments.json

@@ -0,0 +1,16 @@
+[
+  [10, "ignition", "jitless", "d8"],
+  [10, "ignition", "slow_path", "d8"],
+  [5, "ignition_no_ic", "slow_path", "d8"],
+  [5, "ignition", "slow_path_opt", "d8"],
+  [5, "ignition", "ignition_turbo_no_ic", "d8"],
+  [15, "ignition", "ignition_turbo_opt", "d8"],
+  [5, "ignition_no_ic", "ignition_turbo_opt", "d8"],
+  [15, "ignition", "ignition_maglev", "d8"],
+  [5, "ignition_turbo", "ignition_turbo_opt", "clang_x64_fuzzer_experiments/d8"],
+  [5, "ignition", "ignition", "clang_x86/d8"],
+  [5, "ignition", "ignition_turbo_opt", "clang_x86/d8"],
+  [5, "ignition", "slow_path", "clang_x86/d8"],
+  [5, "ignition", "ignition_turbo_opt", "clang_x64_v8_arm64/d8"],
+  [5, "ignition", "ignition_turbo_opt", "clang_x86_v8_arm/d8"]
+]

deps/v8/tools/clusterfuzz/foozzie/v8_fuzz_flags.json

@@ -0,0 +1,41 @@
+[
+  [0.05, "--stress-compaction-random"],
+  [0.05, "--stress-delay-tasks"],
+  [0.05, "--stress-marking=100"],
+  [0.05, "--stress-scavenge=100"],
+  [0.05, "--random-gc-interval=2000"],
+  [0.2, "--noanalyze-environment-liveness"],
+  [0.01, "--thread-pool-size=1"],
+  [0.01, "--thread-pool-size=2"],
+  [0.01, "--thread-pool-size=4"],
+  [0.01, "--thread-pool-size=8"],
+  [0.25, "--jit-fuzzing"],
+  [0.25, "--future"],
+  [0.1, "--regexp-interpret-all"],
+  [0.1, "--regexp-tier-up-ticks=0"],
+  [0.1, "--regexp-tier-up-ticks=10"],
+  [0.1, "--regexp-tier-up-ticks=100"],
+  [0.1, "--turbo-instruction-scheduling"],
+  [0.1, "--turbo-stress-instruction-scheduling"],
+  [0.1, "--no-enable-sse4_2"],
+  [0.1, "--no-enable-sahf"],
+  [0.1, "--no-enable-avx"],
+  [0.1, "--no-enable-fma3"],
+  [0.1, "--no-enable-bmi1"],
+  [0.1, "--no-enable-bmi2"],
+  [0.1, "--no-enable-lzcnt"],
+  [0.1, "--no-enable-popcnt"],
+  [0.25, "--no-lazy-feedback-allocation"],
+  [0.1, "--no-wasm-generic-wrapper"],
+  [0.2, "--turboshaft"],
+  [0.05, "--turbolev"],
+  [0.5, "--optimize-on-next-call-optimizes-to-maglev"],
+  [0.0001, "--simulate-errors"],
+  [0.1, "--minor-ms"],
+  [0.1, "--shared-string-table"],
+  [0.1, "--shared-heap"],
+  [0.1, "--stress-wasm-memory-moving"],
+  [0.1, "--stress-scavenger-conservative-object-pinning-random"],
+  [0.1, "--precise-object-pinning"],
+  [0.1, "--ephemeron-fixpoint-iterations=0"]
+]

deps/v8/tools/clusterfuzz/foozzie/v8_mock.js

@@ -0,0 +1,291 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This is intended for permanent JS behavior changes for mocking out
+// non-deterministic behavior. For temporary suppressions, please refer to
+// v8_suppressions.js.
+// This file is loaded before each correctness test cases and won't get
+// minimized.
+
+
+// This will be overridden in the test cases. The override can be minimized.
+var prettyPrinted = function prettyPrinted(msg) { return msg; };
+
+// Mock Math.random.
+(function() {
+  let index = 1;
+  Math.random = function() {
+      const x = Math.sin(index++) * 10000;
+      return x - Math.floor(x);
+  }
+})();
+
+// Mock Date.
+(function() {
+  let index = 0;
+  let mockDate = 1477662728696;
+  const mockDateNow = function() {
+    index = (index + 1) % 10;
+    mockDate = mockDate + index + 1;
+    return mockDate;
+  }
+
+  const origDate = Date;
+  const construct = Reflect.construct;
+  const constructDate = function(args) {
+    let result;
+    if (args.length) {
+      result = construct(origDate, args);
+    } else {
+      result = new origDate(mockDateNow());
+    }
+    result.constructor = function(...args) { return constructDate(args); }
+    Object.defineProperty(
+        result, "constructor", { configurable: false, writable: false });
+    return result;
+  }
+
+  origDate.prototype.constructor = function(...args) {
+    return constructDate(args);
+  };
+
+  var handler = {
+    apply: function(target, thisArg, args) {
+      return constructDate(args);
+    },
+    construct: function(target, args, newTarget) {
+      return constructDate(args);
+    },
+    get: function(target, property, receiver) {
+      if (property == "now") {
+        return mockDateNow;
+      }
+      if (property == "prototype") {
+        return origDate.prototype;
+      }
+    },
+  }
+
+  Date = new Proxy(Date, handler);
+})();
+
+// Mock performance methods.
+performance.now = function() { return 1.2; };
+performance.mark = function() { return undefined; };
+performance.measure = function() { return undefined; };
+performance.measureMemory = function() { return []; };
+
+// Mock readline so that test cases don't hang.
+readline = function() { return "foo"; };
+
+// Mock stack traces.
+Error.prepareStackTrace = function(error, structuredStackTrace) {
+  return "";
+};
+Object.defineProperty(
+    Error, 'prepareStackTrace', { configurable: false, writable: false });
+
+// Mock buffer access in float typed arrays because of varying NaN patterns.
+(function() {
+  const origArrayFrom = Array.from;
+  const origArrayIsArray = Array.isArray;
+  const origFunctionPrototype = Function.prototype;
+  const origArrayMap = Array.prototype.map;
+  const applyOrigArrayMap = origFunctionPrototype.apply.bind(origArrayMap);
+  const origIsNaN = isNaN;
+  const origIterator = Symbol.iterator;
+  const deNaNify = function(value) { return origIsNaN(value) ? 1 : value; };
+  const mock = function(type) {
+
+    // Remove NaN values from parameters to "set" function.
+    const set = type.prototype.set;
+    type.prototype.set = function(array, offset) {
+      if (origArrayIsArray(array)) {
+        array = applyOrigArrayMap(array, [deNaNify]);
+      }
+      set.apply(this, [array, offset]);
+    };
+
+    const handler = {
+      // Remove NaN values from parameters to constructor.
+      construct: function(target, args) {
+        for (let i = 0; i < args.length; i++) {
+          if (args[i] != null &&
+              typeof args[i][origIterator] === 'function') {
+            // Consume iterators.
+            args[i] = origArrayFrom(args[i]);
+          }
+          if (origArrayIsArray(args[i])) {
+            args[i] = applyOrigArrayMap(args[i], [deNaNify]);
+          }
+        }
+
+        const obj = new (
+            origFunctionPrototype.bind.call(type, null, ...args));
+        return new Proxy(obj, {
+          get: function(x, prop) {
+            if (typeof x[prop] == "function")
+              return x[prop].bind(obj);
+            return x[prop];
+          },
+          // Remove NaN values that get assigned.
+          set: function(target, prop, value, receiver) {
+            target[prop] = deNaNify(value);
+            return value;
+          }
+        });
+      },
+    };
+    return new Proxy(type, handler);
+  }
+
+  Float32Array = mock(Float32Array);
+  Float64Array = mock(Float64Array);
+})();
+
+// Mock buffer access via DataViews because of varying NaN patterns.
+(function() {
+  const origIsNaN = isNaN;
+  const deNaNify = function(value) { return origIsNaN(value) ? 1 : value; };
+  const origSetFloat32 = DataView.prototype.setFloat32;
+  DataView.prototype.setFloat32 = function(offset, value, ...rest) {
+    origSetFloat32.call(this, offset, deNaNify(value), ...rest);
+  };
+  const origSetFloat64 = DataView.prototype.setFloat64;
+  DataView.prototype.setFloat64 = function(offset, value, ...rest) {
+    origSetFloat64.call(this, offset, deNaNify(value), ...rest);
+  };
+})();
+
+// Mock maximum typed-array buffer and limit to 1MiB. Otherwise we might
+// get range errors. We ignore those by crashing, but that reduces coverage,
+// hence, let's reduce the range-error rate.
+(function() {
+  // Math.min might be manipulated in test cases.
+  const min = Math.min;
+  const maxBytes = 1048576;
+  const mock = function(type) {
+    const maxLength = maxBytes / (type.BYTES_PER_ELEMENT || 1);
+    const handler = {
+      construct: function(target, args) {
+        if (args[0] && typeof args[0] != "object") {
+          // Length used as first argument.
+          args[0] = min(maxLength, Number(args[0]));
+        } else if (args[0] instanceof ArrayBuffer && args.length > 1) {
+          // Buffer used as first argument.
+          const buffer = args[0];
+          args[1] = Number(args[1]);
+          // Ensure offset is multiple of bytes per element.
+          args[1] = args[1] - (args[1] % type.BYTES_PER_ELEMENT);
+          // Limit offset to length of buffer.
+          args[1] = min(args[1], buffer.byteLength || 0);
+          if (args.length > 2) {
+            // If also length is given, limit it to the maximum that's possible
+            // given buffer and offset. Avoid NaN offset turning the length
+            // NaN, too.
+            const maxBytesLeft = buffer.byteLength - (args[1] || 0);
+            const maxLengthLeft = maxBytesLeft / type.BYTES_PER_ELEMENT;
+            args[2] = min(Number(args[2]), maxLengthLeft);
+          }
+        }
+        return new (Function.prototype.bind.apply(type, [null].concat(args)));
+      },
+    };
+    return new Proxy(type, handler);
+  }
+
+  ArrayBuffer = mock(ArrayBuffer);
+  SharedArrayBuffer = mock(SharedArrayBuffer);
+  Int8Array = mock(Int8Array);
+  Uint8Array = mock(Uint8Array);
+  Uint8ClampedArray = mock(Uint8ClampedArray);
+  Int16Array = mock(Int16Array);
+  Uint16Array = mock(Uint16Array);
+  Int32Array = mock(Int32Array);
+  Uint32Array = mock(Uint32Array);
+  BigInt64Array = mock(BigInt64Array);
+  BigUint64Array = mock(BigUint64Array);
+  Float32Array = mock(Float32Array);
+  Float64Array = mock(Float64Array);
+})();
+
+// Mock typed array set function and cap offset to not throw a range error.
+(function() {
+  // Math.min might be manipulated in test cases.
+  const min = Math.min;
+  const types = [
+    Int8Array,
+    Uint8Array,
+    Uint8ClampedArray,
+    Int16Array,
+    Uint16Array,
+    Int32Array,
+    Uint32Array,
+    BigInt64Array,
+    BigUint64Array,
+    Float32Array,
+    Float64Array,
+  ];
+  for (const type of types) {
+    const set = type.prototype.set;
+    type.prototype.set = function(array, offset) {
+      if (Array.isArray(array)) {
+        offset = Number(offset);
+        offset = min(offset, this.length - array.length);
+      }
+      set.call(this, array, offset);
+    };
+  }
+})();
+
+// Mock Worker.
+(function() {
+  let index = 0;
+  // TODO(machenbach): Randomize this for each test case, but keep stable
+  // during comparison. Also data and random above.
+  const workerMessages = [
+    undefined, 0, -1, "", "foo", 42, [], {}, [0], {"x": 0}
+  ];
+  Worker = function(code){
+    try {
+      print(prettyPrinted(eval(code)));
+    } catch(e) {
+      print(prettyPrinted(e));
+    }
+    this.getMessage = function(){
+      index = (index + 1) % 10;
+      return workerMessages[index];
+    }
+    this.postMessage = function(msg){
+      print(prettyPrinted(msg));
+    }
+  };
+})();
+
+// Mock Realm.
+Realm.eval = function(realm, code) { return eval(code) };
+
+// Mock the nondeterministic parts of WeakRef and FinalizationRegistry.
+WeakRef.prototype.deref = function() { };
+FinalizationRegistry = function(callback) { };
+FinalizationRegistry.prototype.register = function(target, holdings) { };
+FinalizationRegistry.prototype.unregister = function(unregisterToken) { };
+FinalizationRegistry.prototype.cleanupSome = function() { };
+FinalizationRegistry.prototype[Symbol.toStringTag] = "FinalizationRegistry";
+
+// Mock the nondeterministic Atomics.waitAsync.
+Atomics.waitAsync = function() {
+  // Return a mock "Promise" whose "then" function will call the callback
+  // immediately.
+  return {'value': {'then': function (f) { f(); }}};
+}
+
+// Mock serializer API with no-ops.
+d8.serializer = {'serialize': (x) => x, 'deserialize': (x) => x}
+
+// Mock profiler API with no-ops.
+d8.profiler = {'setOnProfileEndListener': (x) => x, 'triggerSample': (x) => x}
+
+// Mock logging API with no-ops.
+d8.log = {'getAndStop': (x) => x}

deps/v8/tools/clusterfuzz/foozzie/v8_mock_archs.js

@@ -0,0 +1,25 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This is intended for permanent JS behavior changes for mocking out
+// non-deterministic behavior. For temporary suppressions, please refer to
+// v8_suppressions.js.
+// This mocks only architecture specific differences. Refer to v8_mocks.js
+// for the general case.
+// This file is loaded before each correctness test cases and won't get
+// minimized.
+
+// Mock Math.pow due to precision differences between 32 and 64 bits.
+// https://crbug.com/380147861
+// https://crbug.com/380322452
+// https://crbug.com/381129314
+(function() {
+  const origMathPow = Math.pow;
+  const origNumber = Number;
+  const origToExponential = Number.prototype.toExponential;
+  Math.pow = function(a, b) {
+    let result = origMathPow(a, b);
+    return origNumber(origToExponential.call(result, 11));
+  }
+})();

deps/v8/tools/clusterfuzz/foozzie/v8_mock_webassembly.js

@@ -0,0 +1,18 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This mocks out the WebAssembly object with a permissive dummy.
+
+(function() {
+  const handler = {
+    get: function(x, prop) {
+      if (prop == Symbol.toPrimitive) {
+        return function() { return undefined; };
+      }
+      return dummy;
+    },
+  };
+  const dummy = new Proxy(function() { return dummy; }, handler);
+  WebAssembly = dummy;
+})();

deps/v8/tools/clusterfuzz/foozzie/v8_smoke_tests.js

@@ -0,0 +1,55 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This file is executed separately before the correctness test case. Add here
+// checking of global properties that should never differ in any configuration.
+// A difference found in the prints below will prevent any further correctness
+// comparison for the selected configurations to avoid flooding bugs.
+
+print("https://crbug.com/932656");
+print(Object.getOwnPropertyNames(this));
+
+print("https://crbug.com/935800");
+(function () {
+  function foo() {
+    "use asm";
+    function baz() {}
+    return {bar: baz};
+  }
+  print(Object.getOwnPropertyNames(foo().bar));
+})();
+
+print("https://crbug.com/985154");
+(function () {
+  "use strict";
+  function foo() {
+    "use asm";
+    function baz() {}
+    return {bar: baz};
+  }
+  print(Object.getOwnPropertyNames(foo().bar));
+})();
+
+print("Sensitive runtime functions are neutered");
+(function () {
+  function foo() {}
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+  print(%GetOptimizationStatus(foo));
+  const fun = new Function("f", "return %GetOptimizationStatus(f);");
+  print(fun(foo));
+})();
+
+print("Same constants across builds");
+(function () {
+  for (let [k, v] of Object.entries(this.d8.constants)) {
+    print(`${k}:${v}`)
+  }
+})();
+
+// Don't change this line, it's used to separate smoketest output.
+print("___foozzie___smoke_test_end___");

deps/v8/tools/clusterfuzz/foozzie/v8_suppressions.js

@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This file is loaded before each correctness test case and after v8_mock.js.
+// You can temporarily change JS behavior here to silence known problems.
+// Please refer to a bug in a comment and remove the suppression once the
+// problem is fixed.

deps/v8/tools/clusterfuzz/foozzie/v8_suppressions.py

@@ -0,0 +1,290 @@
+# Copyright 2016 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+"""
+Suppressions for V8 correctness fuzzer failures.
+
+We support three types of suppressions:
+1. Ignore test case by pattern.
+Map a regular expression to a bug entry. A new failure will be reported
+when the pattern matches a JS test case.
+Subsequent matches will be recoreded under the first failure.
+
+2. Ignore test run by output pattern:
+Map a regular expression to a bug entry. A new failure will be reported
+when the pattern matches the output of a particular run.
+Subsequent matches will be recoreded under the first failure.
+
+3. Relax line-to-line comparisons with expressions of lines to ignore and
+lines to be normalized (i.e. ignore only portions of lines).
+These are not tied to bugs, be careful to not silently switch off this tool!
+
+Alternatively, think about adding a behavior change to v8_suppressions.js
+to silence a particular class of problems.
+"""
+
+import re
+
+from itertools import zip_longest
+
+# Max line length for regular experessions checking for lines to ignore.
+MAX_LINE_LENGTH = 512
+
+# Ignore by output pattern. Map from bug->regexp like above.
+IGNORE_OUTPUT = {
+  '_fake_difference_':
+      re.compile(r'^.*___fake_difference___$', re.M),
+}
+
+# Avoid cross-arch comparisons if we find this string in the output.
+# We also need to ignore this output in the diffs as this string might
+# only be printed in the baseline run.
+AVOID_CROSS_ARCH_COMPARISON_RE = (
+    r'^Warning: This run cannot be compared across architectures\.$')
+
+# Lines matching any of the following regular expressions will be ignored.
+# Use uncompiled regular expressions - they'll be compiled later.
+# All expressions must end with a $ without linebreak.
+IGNORE_LINES = [
+  r'^Warning: .+ is deprecated.*$',
+  r'^Try --help for options$',
+  AVOID_CROSS_ARCH_COMPARISON_RE,
+]
+
+# List of pairs (<flag string>, <regexp string>). If the regexp matches the
+# test content, the flag is dropped from the command line of any run.
+# If the flag is part of the third run, the entire run is dropped, as it
+# in many cases would just be redundant to the second default run.
+DROP_FLAGS_ON_CONTENT = [
+    ('--jitless', r'\%Wasm(Struct|Array|GenerateRandomModule)\('),
+]
+
+###############################################################################
+# Implementation - you should not need to change anything below this point.
+
+# We'll match the linebreak explicitly to remove it as well.
+assert all(exp.endswith('$') for exp in IGNORE_LINES)
+assert not any(exp.endswith('\n$') for exp in IGNORE_LINES)
+IGNORE_LINES = [exp[:-1] + '\n' for exp in IGNORE_LINES]
+
+# Compile regular expressions.
+IGNORE_LINES = [re.compile(exp.encode('utf-8'), re.M) for exp in IGNORE_LINES]
+
+ORIGINAL_SOURCE_PREFIX = 'v8-foozzie source: '
+
+SMOKE_TEST_SOURCE = 'foozzie smoke test'
+
+SMOKE_TEST_END_TOKEN = '___foozzie___smoke_test_end___'
+
+SMOKE_TEST_OUTPUT_RE = f'(.*?){SMOKE_TEST_END_TOKEN}'
+
+SMOKE_TEST_INVERSE_OUTPUT_RE = f'.*?{SMOKE_TEST_END_TOKEN}\\s(.*)'
+
+
+def get_output_capped(output1, output2):
+  """Returns a pair of stdout byte arrays.
+
+  The arrays are safely capped if at least one run has crashed.
+  """
+
+  # No length difference or no crash -> no capping.
+  if (len(output1.stdout_bytes) == len(output2.stdout_bytes) or
+      (not output1.HasCrashed() and not output2.HasCrashed())):
+    return output1.stdout_bytes, output2.stdout_bytes
+
+  # Both runs have crashed, cap by the shorter output.
+  if output1.HasCrashed() and output2.HasCrashed():
+    cap = min(len(output1.stdout_bytes), len(output2.stdout_bytes))
+  # Only the first run has crashed, cap by its output length.
+  elif output1.HasCrashed():
+    cap = len(output1.stdout_bytes)
+  # Similar if only the second run has crashed.
+  else:
+    cap = len(output2.stdout_bytes)
+
+  return output1.stdout_bytes[0:cap], output2.stdout_bytes[0:cap]
+
+
+def short_line_output(line):
+  if len(line) <= MAX_LINE_LENGTH:
+    # Avoid copying.
+    return line
+  return line[0:MAX_LINE_LENGTH] + '...'
+
+
+def diff_output(lines1, lines2):
+  """Returns a tuple (difference, source).
+
+  The difference is None if there's no difference, otherwise a string
+  with a readable diff.
+
+  The source is the last source output within the test case, or None if no
+  such output existed.
+  """
+  # This keeps track where we are in the original source file of the fuzz
+  # test case. We always start with the smoke-test part.
+  source = SMOKE_TEST_SOURCE
+
+  for line1, line2 in zip_longest(lines1, lines2, fillvalue=None):
+
+    # Only one of the two iterators should run out.
+    assert not (line1 is None and line2 is None)
+
+    # One iterator ends earlier.
+    if line1 is None:
+      return f'+ {short_line_output(line2)}', source
+    if line2 is None:
+      return f'- {short_line_output(line1)}', source
+
+    # Lines are equal.
+    if line1 == line2:
+      # Instrumented original-source-file output must be equal in both
+      # versions. It only makes sense to update it here when both lines
+      # are equal.
+      if source == SMOKE_TEST_SOURCE and line1 == SMOKE_TEST_END_TOKEN:
+        source = None
+      elif line1.startswith(ORIGINAL_SOURCE_PREFIX):
+        source = line1[len(ORIGINAL_SOURCE_PREFIX):]
+      continue
+
+    # Lines are different.
+    short_line1 = short_line_output(line1)
+    short_line2 = short_line_output(line2)
+    return f'- {short_line1}\n+ {short_line2}', source
+
+  # No difference found.
+  return None, source
+
+
+def get_suppression(skip=False):
+  return V8Suppression(skip)
+
+
+def decode(output):
+  try:
+    return output.decode('utf-8')
+  except UnicodeDecodeError:
+    return output.decode('latin-1')
+
+
+def ignore_lines(text):
+  result = text
+  for line_re in IGNORE_LINES:
+    result = line_re.sub(b'', result)
+  return result
+
+
+class V8Suppression(object):
+  def __init__(self, skip):
+    if skip:
+      self.ignore_output = {}
+      self.drop_flags_on_content = []
+    else:
+      self.ignore_output = IGNORE_OUTPUT
+      self.drop_flags_on_content = DROP_FLAGS_ON_CONTENT
+
+  def diff(self, output1, output2):
+    """Diff capped lines in the presence of crashes."""
+
+    # We remove ignored lines in the raw bytes before output capping, as such
+    # a line might be present in the non-crash run. The crashy run however
+    # determines the byte length and might cap the to-be-ignored line right
+    # in the middle otherwise (https://crbug.com/381384408).
+    output1.stdout_bytes = ignore_lines(output1.stdout_bytes)
+    output2.stdout_bytes = ignore_lines(output2.stdout_bytes)
+
+    # We need to cap raw bytes before decoding, since bytes in the capped part
+    # could lead to decoding errors and an encoding change of the bytes in the
+    # non-capped part (https://crbug.com/40914456).
+    output1_capped, output2_capped = get_output_capped(output1, output2)
+
+    lines1 = decode(output1_capped).splitlines()
+    lines2 = decode(output2_capped).splitlines()
+
+    return self.diff_lines(lines1, lines2)
+
+  def diff_lines(self, output1_lines, output2_lines):
+    return diff_output(output1_lines, output2_lines)
+
+  def reduced_output(self, output, source):
+    """Return output reduced by the source's origin, either only smoke-test
+    output or only non-smoke-test output.
+    """
+    if source == SMOKE_TEST_SOURCE:
+      exp = SMOKE_TEST_OUTPUT_RE
+    else:
+      exp = SMOKE_TEST_INVERSE_OUTPUT_RE
+    match = re.search(exp, output, re.S)
+    if match:
+      return match.group(1)
+    return output
+
+  def ignore_by_output(self, output):
+    def check(mapping):
+      for bug, exp in mapping.items():
+        if exp.search(output):
+          return bug
+      return None
+    bug = check(self.ignore_output)
+    if bug:
+      return bug
+    return None
+
+  def _remove_config_flag(self, config, flag):
+    if config.has_config_flag(flag):
+      config.remove_config_flag(flag)
+      return [
+          f'Dropped {flag} from {config.label} config based on content rule.'
+      ]
+    return []
+
+  def adjust_configs_by_content(self, execution_configs, testcase):
+    """Modifies the execution configs if the testcase content matches a
+    regular expression defined in DROP_FLAGS_ON_CONTENT above.
+
+    The specified flag is dropped from the first two configs. Further
+    configs are dropped entirely if the specified flag is used.
+
+    Returns: A changelog as a list of strings.
+    """
+    logs = []
+    assert len(execution_configs) > 1
+    for flag, regexp in self.drop_flags_on_content:
+      # Check first if the flag we need to drop appears anywhere. This is
+      # faster than processing the content.
+      if not any(config.has_config_flag(flag) for config in execution_configs):
+        continue
+      if not re.search(regexp, testcase):
+        continue
+      logs += self._remove_config_flag(execution_configs[0], flag)
+      logs += self._remove_config_flag(execution_configs[1], flag)
+      for config in execution_configs[2:]:
+        if config.has_config_flag(flag):
+          execution_configs.remove(config)
+          logs.append(f'Dropped {config.label} config using '
+                      f'{flag} based on content rule.')
+    return logs
+
+  def adjust_configs_by_output(self, execution_configs, output):
+    """Modifies the execution configs if the baseline output contains a
+    certain directive.
+
+    Currently this only searches for one particular directive, after which
+    we ensure to compare on the same architecture.
+
+    Returns: A changelog as a list of strings.
+    """
+    # Cross-arch configs have a same-arch fallback. Check first if there
+    # are any, as this check is very cheap.
+    logs = []
+    if not any(config.fallback for config in execution_configs):
+      return []
+    if not re.search(AVOID_CROSS_ARCH_COMPARISON_RE, output, re.M):
+      return []
+    for i, config in enumerate(execution_configs):
+      if config.fallback:
+        logs.append(
+            f'Running the {config.label} config on the same architecture.')
+        execution_configs[i] = config.fallback
+    return logs