Upload Kmake

deps/v8/tools/clusterfuzz/js_fuzzer/resources/async_iterator.js

@@ -0,0 +1,9 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+  AsyncIterator;
+} catch (e) {
+  this.AsyncIterator = class AsyncIterator extends Iterator {}
+}

deps/v8/tools/clusterfuzz/js_fuzzer/resources/chakra_stubs.js

@@ -0,0 +1,11 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// WasmSpec tests in the chakra testsuite use a lot of test(() => ...)
+// patterns.
+function test(fun) {
+  try {
+    fun();
+  } catch(e) {}
+}

deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_1.js

@@ -0,0 +1,8 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let a = 0;
+let b = 0;
+
+console.log(42);

deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_2.js

@@ -0,0 +1,16 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let a = 0;
+let b = 0;
+
+class A {
+
+}
+
+class B extends A {
+  constructor() {
+    console.log(42);
+  }
+}

deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_3.js

@@ -0,0 +1,16 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let a = 0;
+let b = 0;
+
+class A {
+  foo() {}
+}
+
+class B extends A {
+  foo() {
+    console.log(42);
+  }
+}

deps/v8/tools/clusterfuzz/js_fuzzer/resources/differential_fuzz_chakra.js

@@ -0,0 +1,17 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+// Adjust chakra behavior for differential fuzzing.
+
+this.WScript = new Proxy({}, {
+  get(target, name) {
+    switch (name) {
+      case 'Echo':
+        return __prettyPrintExtra;
+      default:
+        return {};
+    }
+  }
+});

deps/v8/tools/clusterfuzz/js_fuzzer/resources/differential_fuzz_jstest.js

@@ -0,0 +1,11 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function debug(msg) {
+  __prettyPrintExtra(msg);
+}
+
+function shouldBe(_a) {
+  __prettyPrintExtra((typeof _a == "function" ? _a() : eval(_a)));
+}

deps/v8/tools/clusterfuzz/js_fuzzer/resources/differential_fuzz_library.js

@@ -0,0 +1,122 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+// Helpers for printing in correctness fuzzing.
+
+// Global helper functions for printing.
+var __prettyPrint;
+var __prettyPrintExtra;
+
+// Track caught exceptions.
+var __caught = 0;
+
+// Track a hash of all printed values - printing is cut off after a
+// certain size.
+var __hash = 0;
+
+(function() {
+  const charCodeAt = String.prototype.charCodeAt;
+  const join = Array.prototype.join;
+  const map = Array.prototype.map;
+  const substring = String.prototype.substring;
+  const toString = Object.prototype.toString;
+
+  // Same as in mjsunit.js.
+  const classOf = function(object) {
+    // Argument must not be null or undefined.
+    const string = toString.call(object);
+    // String has format [object <ClassName>].
+    return substring.call(string, 8, string.length - 1);
+  };
+
+  // For standard cases use original prettyPrinted from mjsunit.
+  const origPrettyPrinted = prettyPrinted;
+
+  // Override prettyPrinted with a version that also recusively prints objects
+  // and arrays with a depth of 4. We don't track circles, but we'd cut off
+  // after a depth of 4 if there are any.
+  prettyPrinted = function prettyPrinted(value, depth=4) {
+    if (depth <= 0) {
+      return "...";
+    }
+    switch (typeof value) {
+      case "object":
+        if (value === null) return "null";
+        switch (classOf(value)) {
+          case "Array":
+            return prettyPrintedArray(value, depth);
+          case "Object":
+            return prettyPrintedObject(value, depth);
+        }
+    }
+    // Fall through to original version for all other types.
+    return origPrettyPrinted(value);
+  }
+
+  // Helper for pretty array with depth.
+  function prettyPrintedArray(array, depth) {
+    const result = map.call(array, (value, index, array) => {
+      if (value === undefined && !(index in array)) return "";
+      return prettyPrinted(value, depth - 1);
+    });
+    return `[${join.call(result, ", ")}]`;
+  }
+
+  // Helper for pretty objects with depth.
+  function prettyPrintedObject(object, depth) {
+    const keys = Object.keys(object);
+    const prettyValues = map.call(keys, (key) => {
+      return `${key}: ${prettyPrinted(object[key], depth - 1)}`;
+    });
+    const content = join.call(prettyValues, ", ");
+    return `${object.constructor.name || "Object"}{${content}}`;
+  }
+
+  // Helper for calculating a hash code of a string.
+  function hashCode(str) {
+      let hash = 0;
+      if (str.length == 0) {
+          return hash;
+      }
+      for (let i = 0; i < str.length; i++) {
+          const char = charCodeAt.call(str, i);
+          hash = ((hash << 5) - hash) + char;
+          hash = hash & hash;
+      }
+      return hash;
+  }
+
+  // Upper limit for calling extra printing. When reached, hashes of
+  // strings are tracked and printed instead.
+  let maxExtraPrinting = 100;
+
+  // Helper for pretty printing.
+  __prettyPrint = function(value, extra=false) {
+    let str = prettyPrinted(value);
+
+    // Change __hash with the contents of the full string to
+    // keep track of differences also when we don't print.
+    const hash = hashCode(str);
+    __hash = hashCode(hash + __hash.toString());
+
+    if (extra && maxExtraPrinting-- <= 0) {
+      return;
+    }
+
+    // Cut off long strings to prevent overloading I/O. We still track
+    // the hash of the full string.
+    if (str.length > 64) {
+      const head = substring.call(str, 0, 54);
+      const tail = substring.call(str, str.length - 10, str.length - 1);
+      str = `${head}[...]${tail}`;
+    }
+
+    print(str);
+  };
+
+  __prettyPrintExtra = function (value) {
+    __prettyPrint(value, true);
+  }
+})();

deps/v8/tools/clusterfuzz/js_fuzzer/resources/differential_fuzz_mjsunit.js

@@ -0,0 +1,8 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+// Substitute for mjsunit. We reuse prettyPrinted from mjsunit, but only if
+// it is loaded. If not, we use this substitute instead.
+let prettyPrinted = value => value;

deps/v8/tools/clusterfuzz/js_fuzzer/resources/differential_fuzz_suppressions.js

@@ -0,0 +1,12 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+// Don't breach stack limit in differential fuzzing as it leads to
+// early bailout.
+runNearStackLimit = function(f) {
+  try {
+    f();
+  } catch (e) {}
+};

deps/v8/tools/clusterfuzz/js_fuzzer/resources/differential_fuzz_v8.js

@@ -0,0 +1,29 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+// Adjust mjsunit behavior for differential fuzzing.
+
+// We're not interested in stack traces.
+MjsUnitAssertionError = () => {};
+
+// Do more printing in assertions for more correctness coverage.
+failWithMessage = message => { __prettyPrint(message); };
+assertSame = (expected, found, name_opt) => { __prettyPrint(found); };
+assertNotSame = (expected, found, name_opt) => { __prettyPrint(found); };
+assertEquals = (expected, found, name_opt) => { __prettyPrint(found); };
+assertNotEquals = (expected, found, name_opt) => { __prettyPrint(found); };
+assertNull = (value, name_opt) => { __prettyPrint(value); };
+assertNotNull = (value, name_opt) => { __prettyPrint(value); };
+
+// Suppress optimization status as it leads to false positives.
+assertUnoptimized = () => {};
+assertOptimized = () => {};
+isNeverOptimize = () => {};
+isAlwaysOptimize = () => {};
+isInterpreted = () => {};
+isBaseline = () => {};
+isUnoptimized = () => {};
+isOptimized = () => {};
+isTurboFanned = () => {};

deps/v8/tools/clusterfuzz/js_fuzzer/resources/fuzz_library.js

@@ -0,0 +1,140 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slightly modified variants from http://code.fitness/post/2016/01/javascript-enumerate-methods.html.
+function __isPropertyOfType(obj, name, type) {
+  let desc;
+  try {
+    desc = Object.getOwnPropertyDescriptor(obj, name);
+  } catch(e) {
+    return false;
+  }
+
+  if (!desc)
+    return false;
+
+  return typeof type === 'undefined' || typeof desc.value === type;
+}
+
+function __getProperties(obj, type) {
+  if (typeof obj === "undefined" || obj === null)
+    return [];
+
+  let properties = [];
+  for (let name of Object.getOwnPropertyNames(obj)) {
+    if (__isPropertyOfType(obj, name, type))
+      properties.push(name);
+  }
+
+  let proto = Object.getPrototypeOf(obj);
+  while (proto && proto != Object.prototype) {
+    Object.getOwnPropertyNames(proto)
+      .forEach (name => {
+        if (name !== 'constructor') {
+          if (__isPropertyOfType(proto, name, type))
+            properties.push(name);
+        }
+      });
+    proto = Object.getPrototypeOf(proto);
+  }
+  return properties;
+}
+
+function* __getObjects(root = this, level = 0) {
+    if (level > 4)
+      return;
+
+    let obj_names = __getProperties(root, 'object');
+    for (let obj_name of obj_names) {
+      let obj = root[obj_name];
+      if (obj === root)
+        continue;
+
+      yield obj;
+      yield* __getObjects(obj, level + 1);
+    }
+}
+
+var __getRandomObject;
+{
+  let count = 0;
+  __getRandomObject = function(seed) {
+    if (count++ > 50) return this;
+    let objects = [];
+    for (let obj of __getObjects()) {
+      objects.push(obj);
+    }
+
+    return objects[seed % objects.length];
+  };
+}
+
+var __getRandomProperty;
+{
+  let count = 0;
+  __getRandomProperty = function(obj, seed) {
+    if (count++ > 50) return undefined;
+    let properties = __getProperties(obj);
+    if (!properties.length)
+      return undefined;
+
+    return properties[seed % properties.length];
+  };
+}
+
+var __callRandomFunction;
+{
+  let count = 0;
+  __callRandomFunction = function(obj, seed, ...args)
+  {
+    if (count++ > 25) return;
+    let functions = __getProperties(obj, 'function');
+    if (!functions.length)
+      return;
+
+    let random_function = functions[seed % functions.length];
+    try {
+      obj[random_function](...args);
+    } catch(e) { }
+  };
+}
+
+function runNearStackLimit(f) {
+  function t() {
+    try {
+      return t();
+    } catch (e) {
+      return f();
+    }
+  };
+  try {
+    return t();
+  } catch (e) {}
+}
+
+// Limit number of times we cause GCs in tests to reduce hangs
+// when called within larger loops.
+let __callGC;
+(function() {
+  let countGC = 0;
+  __callGC = function(major) {
+    const type = {type: major ? 'major' : 'minor'};
+    if (countGC++ < 20) {
+      gc(type);
+    }
+  };
+})();
+
+
+function __wrapTC(f) {
+  try {
+    return f();
+  } catch (e) {}
+}
+
+// Neuter common test functions.
+try { this.fail = nop; } catch(e) { }
+try { this.failWithMessage = nop; } catch(e) { }
+try { this.triggerAssertFalse = nop; } catch(e) { }
+try { this.quit = nop; } catch(e) { }

deps/v8/tools/clusterfuzz/js_fuzzer/resources/jstest_stubs.js

@@ -0,0 +1,41 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Minimally stub out methods from JSTest's standalone-pre.js.
+function description(msg) {}
+function debug(msg) {}
+
+function shouldBe(_a) {
+  print((typeof _a == "function" ? _a() : eval(_a)));
+}
+
+function shouldBeTrue(_a) { shouldBe(_a); }
+function shouldBeFalse(_a) { shouldBe(_a); }
+function shouldBeNaN(_a) { shouldBe(_a); }
+function shouldBeNull(_a) { shouldBe(_a); }
+function shouldNotThrow(_a) { shouldBe(_a); }
+function shouldThrow(_a) { shouldBe(_a); }
+
+function noInline() {}
+function finishJSTest() {}
+
+// Stub out $vm.
+try {
+  $vm;
+} catch(e) {
+  const handler = {
+    get: function(x, prop) {
+      if (prop == Symbol.toPrimitive) {
+        return function() { return undefined; };
+      }
+      return dummy;
+    },
+  };
+  const dummy = new Proxy(function() { return dummy; }, handler);
+  this.$vm = dummy;
+}
+
+// Other functions.
+function ensureArrayStorage() {}
+function transferArrayBuffer() {}

deps/v8/tools/clusterfuzz/js_fuzzer/resources/sandbox.js

@@ -0,0 +1,28 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Stub for V8's memory-corruption API.
+
+try {
+  Sandbox;
+} catch (e) {
+  this.Sandbox = {
+    MemoryView: class MemoryView extends ArrayBuffer{},
+    base: undefined,
+    byteLength: 42,
+    getAddressOf: () => 0,
+    getObjectAt: () => undefined,
+    getSizeOf: () => 42,
+    getSizeOfObjectAt: () => 42,
+    isValidObjectAt: () => true,
+    isWritable: () => true,
+    isWritableObjectAt: () => true,
+    getInstanceTypeOf: () => undefined,
+    getInstanceTypeOfObjectAt: () => undefined,
+    getInstanceTypeIdOf: () => undefined,
+    getInstanceTypeIdOfObjectAt: () => undefined,
+    getInstanceTypeIdFor: () => 0,
+    getFieldOffset: () => 31,
+  };
+}

deps/v8/tools/clusterfuzz/js_fuzzer/resources/spidermonkey_stubs.js

@@ -0,0 +1,7 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Required to make a spidermonkey dependency more permissive:
+// spidermonkey/test/expected/import/files/local/smTempBranch/shell.js
+var document = {all: undefined};

deps/v8/tools/clusterfuzz/js_fuzzer/resources/stubs.js

@@ -0,0 +1,39 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Helper neuter function.
+function nop() { return false; }
+
+// Stubs for non-standard functions.
+try { gc; } catch(e) {
+  this.gc = function () {
+    for (let i = 0; i < 10000; i++) {
+      let s = new String("AAAA" + Math.random());
+    }
+  }
+}
+try { uneval; } catch(e) { this.uneval = this.nop; }
+
+// For Spidermonkey shell.
+try { gcparam; } catch(e) { this.gcparam = this.nop; }
+
+try {
+  // For Chakra tests.
+  WScript;
+} catch(e) {
+  this.WScript = new Proxy({}, {
+    get(target, name) {
+      switch (name) {
+        case 'Echo':
+          return print;
+        default:
+          return {};
+      }
+
+    }
+  });
+}
+
+try { this.alert = console.log; } catch(e) { }
+try { this.print = console.log; } catch(e) { }