Revert "[code generators] Introduce explicit "useInPrefix""

This reverts commit a799a23.

Reason for revert: Suspected to crash with:
Fatal error: Code generators must contain at least one generator to be used in the prefix

Original change's description:
> [code generators] Introduce explicit "useInPrefix"
>
> Before this CL, we chose which CodeGenerators to use in the prefix based
> on IsValueGenerator property (= all stubs in the generator require no
> inputs and produce something).
>
> However, we want to have CodeGenerators which satisfy that
> property, but which are not used in the prefix.
>
> This CL solves this problem by adding an explicit way to mark which code
> generators should be used in the prefix.
>
> CONV=fe946adb-0cf0-4d0b-a600-a45a70ecddad
> TAG=agy
> Bug: 526979176
> Change-Id: Ib5dd42efbaf082e7196992c00aa867a23c4609b0
> Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9457934
> Commit-Queue: Marja Hölttä <marja@google.com>
> Reviewed-by: Matthias Liedtke <mliedtke@google.com>

Bug: 526979176
Change-Id: I1acc51b237c4ece57cf9ef7b4637a6bd16c6ebf6
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9482515
Bot-Commit: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Michael Achenbach <machenbach@google.com>
Reviewed-by: Marja Hölttä <marja@google.com>

Author: mi-ac

Sources/Fuzzilli/Base/ProgramBuilder.swift

@@ -2285,11 +2285,11 @@ public class ProgramBuilder {
         build(n: budget, by: .generating)
     }
 
-    /// Run generators marked with "useInPrefix" until we have created at least N new variables.
+    /// Run ValueGenerators until we have created at least N new variables.
     /// Returns both the number of generated instructions and of newly created variables.
     @discardableResult
     public func buildValues(_ n: Int) -> (generatedInstructions: Int, generatedVariables: Int) {
-        var valueGenerators = fuzzer.codeGenerators.filter({ $0.useInPrefix })
+        var valueGenerators = fuzzer.codeGenerators.filter({ $0.isValueGenerator })
         // Filter for the current context
         valueGenerators = valueGenerators.filter { context.contains($0.requiredContext) }
 

Sources/Fuzzilli/CodeGen/CodeGenerator.swift

@@ -69,6 +69,13 @@ private struct GeneratorAdapter4Args: GeneratorAdapter {
 }
 
 public class GeneratorStub: Contributor {
+    /// Whether this code generator is a value generator. A value generator will create at least one new variable containing
+    /// a newly created value (e.g. a primitive value or some kind of object). Further, value generators must be able to
+    /// run even if there are no existing variables. This way, they can be used to "bootstrap" code generation.
+    public var isValueStub: Bool {
+        self.inputs.isEmpty && !self.produces.isEmpty
+    }
+
     /// How many different values of the same type ValueGenerators should aim to generate.
     public static let numberOfValuesToGenerateByValueGenerators = 3
 
@@ -407,22 +414,9 @@ public class CodeGenerator {
     // Here, I think we might have different Contexts that each yield point could provide, e.g. [.javascript | .subroutine, .wasmFunction]. Unsure if there is a situation where this matters? instead of having .javascript | .subroutine | .wasmFunction?
     public let providedContexts: [Context]
 
-    // Whether this code generator shall be used for creating values when bootstrapping code generation.
-    public let useInPrefix: Bool
-
-    public init(_ name: String, useInPrefix: Bool = false, _ generators: [GeneratorStub]) {
+    public init(_ name: String, _ generators: [GeneratorStub]) {
         self.parts = generators
         self.name = name
-        self.useInPrefix = useInPrefix
-
-        if useInPrefix {
-            assert(
-                generators.first!.inputs.isEmpty,
-                "CodeGenerators used in the prefix must not require any inputs")
-            assert(
-                generators.contains { !$0.produces.isEmpty },
-                "CodeGenerators used in the prefix must produce at least one value")
-        }
 
         // Calculate all contexts provided at any time by this CodeGenerator.
         var ctxSet = Set<Context>()
@@ -435,6 +429,12 @@ public class CodeGenerator {
         self.providedContexts = Array(ctxSet)
     }
 
+    // This essentially means that all stubs have no requirements.
+    // Usually there is only a single element in the CodeGenerator if it is a ValueGenerator.
+    public var isValueGenerator: Bool {
+        return self.parts.allSatisfy { $0.isValueStub }
+    }
+
     // This is the context required by the first part of the CodeGenerator.
     public var requiredContext: Context {
         // This has to be a single one for the first Generator.
@@ -469,12 +469,10 @@ public class CodeGenerator {
 
     public convenience init(
         _ name: String, inContext context: GeneratorStub.ContextRequirement = .single(.javascript),
-        produces: [ILType] = [], provides: [Context] = [], useInPrefix: Bool = false,
-        _ f: @escaping GeneratorFuncNoArgs
+        produces: [ILType] = [], provides: [Context] = [], _ f: @escaping GeneratorFuncNoArgs
     ) {
         self.init(
             name,
-            useInPrefix: useInPrefix,
             [
                 GeneratorStub(
                     name: name, inputs: .none, produces: produces, context: context,
@@ -485,12 +483,10 @@ public class CodeGenerator {
     public convenience init(
         _ name: String, inContext context: GeneratorStub.ContextRequirement = .single(.javascript),
         producesComplex: [GeneratorStub.Constraint], provides: [Context] = [],
-        useInPrefix: Bool = false,
         _ f: @escaping GeneratorFuncNoArgs
     ) {
         self.init(
             name,
-            useInPrefix: useInPrefix,
             [
                 GeneratorStub(
                     name: name, inputs: .none, produces: producesComplex, context: context,
@@ -501,13 +497,11 @@ public class CodeGenerator {
     public convenience init(
         _ name: String, inContext context: GeneratorStub.ContextRequirement = .single(.javascript),
         inputs: GeneratorStub.Inputs, produces: [ILType] = [], provides: [Context] = [],
-        useInPrefix: Bool = false,
         _ f: @escaping GeneratorFunc1Arg
     ) {
         assert(inputs.count == 1)
         self.init(
             name,
-            useInPrefix: useInPrefix,
             [
                 GeneratorStub(
                     name: name, inputs: inputs, produces: produces, context: context,
@@ -518,12 +512,11 @@ public class CodeGenerator {
     public convenience init(
         _ name: String, inContext context: GeneratorStub.ContextRequirement = .single(.javascript),
         inputs: GeneratorStub.Inputs, producesComplex: [GeneratorStub.Constraint],
-        provides: [Context] = [], useInPrefix: Bool = false, _ f: @escaping GeneratorFunc1Arg
+        provides: [Context] = [], _ f: @escaping GeneratorFunc1Arg
     ) {
         assert(inputs.count == 1)
         self.init(
             name,
-            useInPrefix: useInPrefix,
             [
                 GeneratorStub(
                     name: name, inputs: inputs, produces: producesComplex, context: context,
@@ -534,13 +527,11 @@ public class CodeGenerator {
     public convenience init(
         _ name: String, inContext context: GeneratorStub.ContextRequirement = .single(.javascript),
         inputs: GeneratorStub.Inputs, produces: [ILType] = [], provides: [Context] = [],
-        useInPrefix: Bool = false,
         _ f: @escaping GeneratorFunc2Args
     ) {
         assert(inputs.count == 2)
         self.init(
             name,
-            useInPrefix: useInPrefix,
             [
                 GeneratorStub(
                     name: name, inputs: inputs, produces: produces, context: context,
@@ -551,13 +542,11 @@ public class CodeGenerator {
     public convenience init(
         _ name: String, inContext context: GeneratorStub.ContextRequirement = .single(.javascript),
         inputs: GeneratorStub.Inputs, produces: [ILType] = [], provides: [Context] = [],
-        useInPrefix: Bool = false,
         _ f: @escaping GeneratorFunc3Args
     ) {
         assert(inputs.count == 3)
         self.init(
             name,
-            useInPrefix: useInPrefix,
             [
                 GeneratorStub(
                     name: name, inputs: inputs, produces: produces, context: context,
@@ -568,13 +557,11 @@ public class CodeGenerator {
     public convenience init(
         _ name: String, inContext context: GeneratorStub.ContextRequirement = .single(.javascript),
         inputs: GeneratorStub.Inputs, produces: [ILType] = [], provides: [Context] = [],
-        useInPrefix: Bool = false,
         _ f: @escaping GeneratorFunc4Args
     ) {
         assert(inputs.count == 4)
         self.init(
             name,
-            useInPrefix: useInPrefix,
             [
                 GeneratorStub(
                     name: name, inputs: inputs, produces: produces, context: context,

Sources/Fuzzilli/CodeGen/CodeGenerators.swift

@@ -258,7 +258,12 @@ func makeObjectDestructForOfLoopGenerator(
 // These insert one or more instructions into a program.
 //
 public let CodeGenerators: [CodeGenerator] = [
-    // Code generators with useInPrefix: true are used to "bootstrap" code generation by creating some initial variables
+    //
+    // Value Generators: Code Generators that generate one or more new values, i.e. they have a `produces` annotation.
+    //
+    // These behave like any other CodeGenerator in that they will be randomly chosen to generate code
+    // and have a weight assigned to them to determine how frequently they are selected, but in addition
+    // ValueGenerators are also used to "bootstrap" code generation by creating some initial variables
     // that following code can then operate on.
     //
     // These:
@@ -268,19 +273,19 @@ public let CodeGenerators: [CodeGenerator] = [
     //  - Should generate |n| different values of the same type, but may generate fewer.
     //  - May be recursive, for example to fill bodies of newly created blocks.
     //
-    CodeGenerator("IntegerGenerator", produces: [.integer], useInPrefix: true) { b in
+    CodeGenerator("IntegerGenerator", produces: [.integer]) { b in
         b.loadInt(b.randomInt())
     },
 
-    CodeGenerator("BigIntGenerator", produces: [.bigint], useInPrefix: true) { b in
+    CodeGenerator("BigIntGenerator", produces: [.bigint]) { b in
         b.loadBigInt(b.randomInt())
     },
 
-    CodeGenerator("FloatGenerator", produces: [.float], useInPrefix: true) { b in
+    CodeGenerator("FloatGenerator", produces: [.float]) { b in
         b.loadFloat(b.randomFloat())
     },
 
-    CodeGenerator("StringGenerator", produces: [.string], useInPrefix: true) { b in
+    CodeGenerator("StringGenerator", produces: [.string]) { b in
         b.loadString(b.randomString())
     },
 
@@ -301,22 +306,22 @@ public let CodeGenerators: [CodeGenerator] = [
         }
     },
 
-    CodeGenerator("BooleanGenerator", produces: [.boolean], useInPrefix: true) { b in
+    CodeGenerator("BooleanGenerator", produces: [.boolean]) { b in
         // It's probably not too useful to generate multiple boolean values here.
         b.loadBool(Bool.random())
     },
 
-    CodeGenerator("UndefinedGenerator", produces: [.undefined], useInPrefix: true) { b in
+    CodeGenerator("UndefinedGenerator", produces: [.undefined]) { b in
         // There is only one 'undefined' value, so don't generate it multiple times.
         b.loadUndefined()
     },
 
-    CodeGenerator("NullGenerator", produces: [.undefined], useInPrefix: true) { b in
+    CodeGenerator("NullGenerator", produces: [.undefined]) { b in
         // There is only one 'null' value, so don't generate it multiple times.
         b.loadNull()
     },
 
-    CodeGenerator("ArrayGenerator", produces: [.jsArray], useInPrefix: true) { b in
+    CodeGenerator("ArrayGenerator", produces: [.jsArray]) { b in
         // If we can only generate empty arrays, then only create one such array.
         if !b.hasVisibleJsVariables {
             b.createArray(with: [])
@@ -328,12 +333,12 @@ public let CodeGenerators: [CodeGenerator] = [
         }
     },
 
-    CodeGenerator("IntArrayGenerator", produces: [.jsArray], useInPrefix: true) { b in
+    CodeGenerator("IntArrayGenerator", produces: [.jsArray]) { b in
         let values = (0..<Int.random(in: 1...10)).map({ _ in b.randomInt() })
         b.createIntArray(with: values)
     },
 
-    CodeGenerator("FloatArrayGenerator", produces: [.jsArray], useInPrefix: true) { b in
+    CodeGenerator("FloatArrayGenerator", produces: [.jsArray]) { b in
         let values = (0..<Int.random(in: 1...10)).map({ _ in b.randomFloat() })
         b.createFloatArray(with: values)
     },
@@ -381,7 +386,7 @@ public let CodeGenerators: [CodeGenerator] = [
         b.callMethod(transitionMethod, on: Object, withArgs: [obj])
     },
 
-    CodeGenerator("BuiltinObjectInstanceGenerator", produces: [.object()], useInPrefix: true) {
+    CodeGenerator("BuiltinObjectInstanceGenerator", produces: [.object()]) {
         b in
         let builtin = chooseUniform(from: [
             "Array", "Map", "WeakMap", "Set", "WeakSet", "Date",
@@ -438,7 +443,7 @@ public let CodeGenerators: [CodeGenerator] = [
             b.constructTemporalDate, b.constructTemporalDateTime, b.constructTemporalZonedDateTime,
         ])()
     },
-    CodeGenerator("TypedArrayGenerator", produces: [.object()], useInPrefix: true) { b in
+    CodeGenerator("TypedArrayGenerator", produces: [.object()]) { b in
         let size = b.loadInt(b.randomSize(upTo: 0x1000))
         let constructor = b.createNamedVariable(
             forBuiltin: chooseUniform(
@@ -614,7 +619,7 @@ public let CodeGenerators: [CodeGenerator] = [
         )
     },
 
-    CodeGenerator("RegExpGenerator", produces: [.jsRegExp], useInPrefix: true) { b in
+    CodeGenerator("RegExpGenerator", produces: [.jsRegExp]) { b in
         let (regexpPattern, flags) = b.randomRegExpPatternAndFlags()
         b.loadRegExp(regexpPattern, flags)
     },
@@ -658,7 +663,7 @@ public let CodeGenerators: [CodeGenerator] = [
         }
     },
 
-    CodeGenerator("ObjectConstructorGenerator", produces: [.constructor()], useInPrefix: true) {
+    CodeGenerator("ObjectConstructorGenerator", produces: [.constructor()]) {
         b in
         let maxProperties = 3
         assert(b.fuzzer.environment.customProperties.count >= maxProperties)
@@ -740,7 +745,7 @@ public let CodeGenerators: [CodeGenerator] = [
         ]
     ),
 
-    CodeGenerator("TrivialFunctionGenerator", produces: [.function()], useInPrefix: true) { b in
+    CodeGenerator("TrivialFunctionGenerator", produces: [.function()]) { b in
         // Generating more than one function has a fairly high probability of generating
         // essentially identical functions, so we just generate one.
         let maybeReturnValue =
@@ -1603,7 +1608,7 @@ public let CodeGenerators: [CodeGenerator] = [
 
     CodeGenerator(
         "StringNormalizeGenerator",
-        produces: [.jsString], useInPrefix: true
+        produces: [.jsString]
     ) { b in
         let form = b.loadString(
             chooseUniform(
@@ -3366,8 +3371,7 @@ public let CodeGenerators: [CodeGenerator] = [
         // assert(b.type(of: imitation) == b.type(of: orig))
     },
 
-    CodeGenerator("ResizableArrayBufferGenerator", produces: [.jsArrayBuffer], useInPrefix: true) {
-        b in
+    CodeGenerator("ResizableArrayBufferGenerator", produces: [.jsArrayBuffer]) { b in
         let size = b.randomSize(upTo: 0x1000)
         var maxSize = b.randomSize()
         if maxSize < size {
@@ -3392,9 +3396,7 @@ public let CodeGenerators: [CodeGenerator] = [
         b.construct(View, withArgs: [ab])
     },
 
-    CodeGenerator(
-        "GrowableSharedArrayBufferGenerator", produces: [.jsSharedArrayBuffer], useInPrefix: true
-    ) { b in
+    CodeGenerator("GrowableSharedArrayBufferGenerator", produces: [.jsSharedArrayBuffer]) { b in
         let size = b.randomSize(upTo: 0x1000)
         var maxSize = b.randomSize()
         if maxSize < size {
@@ -3467,7 +3469,7 @@ public let CodeGenerators: [CodeGenerator] = [
         }
     },
 
-    CodeGenerator("IteratorGenerator", produces: [.iterable()], useInPrefix: true) { b in
+    CodeGenerator("IteratorGenerator", produces: [.iterable()]) { b in
         let iteratorSymbol = b.createSymbolProperty("iterator")
         b.hide(iteratorSymbol)
         let iterableObject = b.buildObjectLiteral { obj in
@@ -3494,7 +3496,7 @@ public let CodeGenerators: [CodeGenerator] = [
         b.setType(ofVariable: iterableObject, to: .iterable() + .object())
     },
 
-    CodeGenerator("DisposableGenerator", produces: [.disposable()], useInPrefix: true) { b in
+    CodeGenerator("DisposableGenerator", produces: [.disposable()]) { b in
         let disposeSymbol = b.createSymbolProperty("dispose")
         b.hide(disposeSymbol)
         b.buildObjectLiteral { obj in
@@ -3503,8 +3505,7 @@ public let CodeGenerators: [CodeGenerator] = [
         }
     },
 
-    CodeGenerator("AsyncDisposableGenerator", produces: [.asyncDisposable()], useInPrefix: true) {
-        b in
+    CodeGenerator("AsyncDisposableGenerator", produces: [.asyncDisposable()]) { b in
         let asyncDisposeSymbol = b.createSymbolProperty("asyncDispose")
         b.hide(asyncDisposeSymbol)
         b.buildObjectLiteral { obj in

Sources/Fuzzilli/CodeGen/WasmCodeGenerators.swift

@@ -25,7 +25,7 @@ public let WasmCodeGenerators: [CodeGenerator] = [
     CodeGenerator(
         "WasmGlobalGenerator",
         inContext: .single(.javascript),
-        produces: [.object(ofGroup: "WasmGlobal")], useInPrefix: true
+        produces: [.object(ofGroup: "WasmGlobal")]
     ) { b in
         b.createWasmGlobal(
             value: b.randomWasmGlobal(forContext: .javascript), isMutable: probability(0.5))
@@ -34,7 +34,7 @@ public let WasmCodeGenerators: [CodeGenerator] = [
     CodeGenerator(
         "WasmMemoryGenerator",
         inContext: .single(.javascript),
-        produces: [.object(ofGroup: "WasmMemory")], useInPrefix: true
+        produces: [.object(ofGroup: "WasmMemory")]
     ) { b in
         let minPages = Int.random(in: 0..<10)
         let isShared = probability(0.5)
@@ -48,7 +48,7 @@ public let WasmCodeGenerators: [CodeGenerator] = [
     CodeGenerator(
         "WasmTableGenerator",
         inContext: .single(.javascript),
-        produces: [.object(ofGroup: "WasmTable")], useInPrefix: true
+        produces: [.object(ofGroup: "WasmTable")]
     ) { b in
         let elementType: ILType = chooseUniform(from: [
             .wasmFuncRef(), .wasmExternRef(), .wasmI31Ref(), .wasmAnyRef(), .wasmEqRef(),
@@ -67,7 +67,7 @@ public let WasmCodeGenerators: [CodeGenerator] = [
     CodeGenerator(
         "WasmTagGenerator",
         inContext: .single(.javascript),
-        produces: [.object(ofGroup: "WasmTag")], useInPrefix: true
+        produces: [.object(ofGroup: "WasmTag")]
     ) { b in
         if probability(0.5) {
             b.createWasmJSTag()

Sources/Fuzzilli/Fuzzer.swift

@@ -263,9 +263,8 @@ public class Fuzzer {
 
     /// Set the CodeGenerators (and their respecitve weight) to use when generating new code.
     public func setCodeGenerators(_ generators: WeightedList<CodeGenerator>) {
-        guard generators.contains(where: { $0.useInPrefix }) else {
-            fatalError(
-                "Code generators must contain at least one generator to be used in the prefix")
+        guard generators.contains(where: { $0.isValueGenerator }) else {
+            fatalError("Code generators must contain at least one value generator")
         }
         // This builds a graph that we need later for scheduling generators.
         self.contextGraph = ContextGraph(