Raphael Herouart
45953d4d0b
Fuzzers such as Fuzzilli and Redline run many testcases in one d8 process (REPRL). Some crashes occur only after other testcases ran in the same process. One testcase alone does not reproduce such a crash, and ClusterFuzz cannot replay a REPRL session. The bundles of `--bundle` do not help. All their parts run in one context. Thus the top-level declarations of two testcases can conflict, and the globals of one testcase stay for the next testcases. With `--bundle-reprl`, d8 reads a bundle that has only `// JS_BUNDLE_SCRIPT` parts. d8 runs each part in the same way as the REPRL loop runs one testcase. It calls `ResetIsolateStateForReprl()`, then it runs the part in a new context with `RunMain()`. Thus a fuzzer can write the testcases that ran before a crash and the crashing testcase into one file that ClusterFuzz can run. Bug: 582623161 Change-Id: Ife8e7ce2ac8936a9915fb5811e0df5f13e98e5fd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8754140 Commit-Queue: Raphael Herouart <rherouart@chromium.org> Reviewed-by: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#111774}
JavaScript tests with expected output
Tests in test/message pass if the output matches the expected output.
Message tests are particularly useful when checking for exact error messages.
Tests and their expected output must have the same filename, with the .js and
.out extension.
foo.js
foo.out
You can use a regex in the expected output instead of the exact path:
*%(basename)s:7: SyntaxError: Detected cycle while resolving name 'a'
Empty lines are ignored in the comparison, but whitespaces are not.
Exact details of the test runner are in testcfg.py.