Add support for rest parameters in functions

This change adds a possibility of generation rest parameters.
The logic in 'randomParameters' was updated to generate a rest parameter with 20% chance whenever possible
The chance is an optional function argument, so we can modify that value in tests (and in the code, if necessary).

Bug: 458042811, 456162872
Change-Id: Idaf6446cfd248878134e7a449746260e44cfb74b
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8741997
Reviewed-by: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Pawel Krawczyk <pawkra@google.com>
Commit-Queue: Dominik Klemba <tacet@google.com>
Auto-Submit: Dominik Klemba <tacet@google.com>

Author: Dominik Klemba

Sources/Fuzzilli/Base/ProgramBuilder.swift

@@ -566,15 +566,15 @@ public class ProgramBuilder {
     //
     // This will attempt to find a parameter types for which at least a few variables of a compatible types are
     // currently available to (potentially) later be used as arguments for calling the generated subroutine.
-    public func randomParameters(n wantedNumberOfParameters: Int? = nil) -> SubroutineDescriptor {
+    public func randomParameters(n wantedNumberOfParameters: Int? = nil, withRestParameterProbability restProbability: Double = 0.2) -> SubroutineDescriptor {
         assert(probabilityOfUsingAnythingAsParameterTypeIfAvoidable >= 0 && probabilityOfUsingAnythingAsParameterTypeIfAvoidable <= 1)
 
         // If the caller didn't specify how many parameters to generated, find an appropriate
         // number of parameters based on how many variables are currently visible (and can
         // therefore later be used as arguments for calling the new function).
         let n: Int
         if let requestedN = wantedNumberOfParameters {
-            assert(requestedN > 0)
+            assert(requestedN >= 0)
             n = requestedN
         } else {
             switch numberOfVisibleVariables {
@@ -603,15 +603,27 @@ public class ProgramBuilder {
         }
 
         var params = ParameterList()
-        for _ in 0..<n {
+
+        let generateRestParameter = n > 0 && probability(restProbability)
+        let numPlainParams = generateRestParameter ? n - 1 : n
+
+        func randomParamType() -> ILType {
             if probability(probabilityOfUsingAnythingAsParameterTypeIfAvoidable) {
-                params.append(.jsAnything)
+                return .jsAnything
             } else {
-                params.append(.plain(chooseUniform(from: candidates)))
+                return chooseUniform(from: candidates)
             }
         }
 
-        // TODO: also generate rest parameters and maybe even optional ones sometimes?
+        for _ in 0..<numPlainParams {
+            params.append(.plain(randomParamType()))
+        }
+
+        if generateRestParameter {
+            params.append(.rest(randomParamType()))
+        }
+
+        // TODO: also generate optional parameters sometimes?
 
         return .parameters(params)
     }

Tests/FuzzilliTests/ProgramBuilderTest.swift

@@ -508,15 +508,15 @@ class ProgramBuilderTests: XCTestCase {
         let i = b.loadInt(42)
         b.loadInt(43)
         b.loadInt(44)
-        XCTAssertEqual(b.randomParameters(n: 1).parameterTypes[0], .integer)
+        XCTAssertEqual(b.randomParameters(n: 1, withRestParameterProbability: 0).parameterTypes[0], .integer)
 
         // The same is true if we have variables of other types, but not enough to
         // ensure that a function using these types as parameter types can be called
         // with multiple different argument values.
         let s = b.loadString("foo")
         let a = b.createIntArray(with: [1, 2, 3])
         let o = b.createObject(with: [:])
-        XCTAssertEqual(b.randomParameters(n: 1).parameterTypes[0], .integer)
+        XCTAssertEqual(b.randomParameters(n: 1, withRestParameterProbability: 0).parameterTypes[0], .integer)
 
         // But as soon as we have a sufficient number of other types as well,
         // we expect those to be used as well.
@@ -530,16 +530,16 @@ class ProgramBuilderTests: XCTestCase {
         let types = [b.type(of: i), b.type(of: s), b.type(of: a), b.type(of: o)]
         var usesOfParameterType = [ILType: Int]()
         for _ in 0..<100 {
-            guard case .plain(let paramType) = b.randomParameters(n: 1).parameterTypes[0] else { return XCTFail("Unexpected parameter" )}
+            guard case .plain(let paramType) = b.randomParameters(n: 1, withRestParameterProbability: 0).parameterTypes[0] else { return XCTFail("Unexpected parameter" )}
             XCTAssert(types.contains(paramType))
             usesOfParameterType[paramType] = (usesOfParameterType[paramType] ?? 0) + 1
         }
         XCTAssert(usesOfParameterType.values.allSatisfy({ $0 > 0 }))
 
         // However, if we set the probability of using .jsAnything as parameter to 100%, we expect to only see .jsAnything parameters.
         b.probabilityOfUsingAnythingAsParameterTypeIfAvoidable = 1.0
-        XCTAssertEqual(b.randomParameters(n: 1).parameterTypes[0], .jsAnything)
-        XCTAssertEqual(b.randomParameters(n: 1).parameterTypes[0], .jsAnything)
+        XCTAssertEqual(b.randomParameters(n: 1, withRestParameterProbability: 0).parameterTypes[0], .jsAnything)
+        XCTAssertEqual(b.randomParameters(n: 1, withRestParameterProbability: 0).parameterTypes[0], .jsAnything)
     }
 
     func testParameterGeneration3() {
@@ -562,7 +562,7 @@ class ProgramBuilderTests: XCTestCase {
         XCTAssertEqual(b.type(of: p1), .object(withProperties: ["x", "y"]))
         XCTAssertEqual(b.type(of: p1), b.type(of: p2))
 
-        let f1 = b.buildPlainFunction(with: b.randomParameters(n: 1)) { args in
+        let f1 = b.buildPlainFunction(with: b.randomParameters(n: 1, withRestParameterProbability: 0)) { args in
             let p = args[0]
             XCTAssertEqual(b.type(of: p), b.type(of: p1))
             XCTAssertEqual(b.type(of: p).properties, ["x", "y"])
@@ -582,7 +582,7 @@ class ProgramBuilderTests: XCTestCase {
         XCTAssert(b.type(of: a1).properties.contains("length"))
         XCTAssert(b.type(of: a1).methods.contains("slice"))
 
-        let f2 = b.buildPlainFunction(with: b.randomParameters(n: 1)) { args in
+        let f2 = b.buildPlainFunction(with: b.randomParameters(n: 1, withRestParameterProbability: 0)) { args in
             let a = args[0]
             XCTAssertEqual(b.type(of: a), b.type(of: a1))
         }
@@ -601,7 +601,7 @@ class ProgramBuilderTests: XCTestCase {
         XCTAssertEqual(b.type(of: n1), b.type(of: n2))
         XCTAssertEqual(b.type(of: n2), b.type(of: n3))
 
-        let f3 = b.buildPlainFunction(with: b.randomParameters(n: 1)) { args in
+        let f3 = b.buildPlainFunction(with: b.randomParameters(n: 1, withRestParameterProbability: 0)) { args in
             let a = args[0]
             XCTAssertEqual(b.type(of: a), b.type(of: n1))
         }
@@ -610,6 +610,21 @@ class ProgramBuilderTests: XCTestCase {
         XCTAssert([n1, n2, n3].contains(args[0]))
     }
 
+    func testRestParameterGeneration() {
+        let fuzzer = makeMockFuzzer()
+        let b = fuzzer.makeBuilder()
+        b.loadInt(42)
+        b.loadInt(43)
+
+        // With probability 1.0, we should always generate a rest parameter if possible.
+        let params = b.randomParameters(n: 2, withRestParameterProbability: 1.0)
+        XCTAssertEqual(params.count, 2)
+        XCTAssert(params.parameters.hasRestParameter)
+        guard case .plain(_) = params.parameterTypes[0] else { return XCTFail("Expected a plain parameter") }
+        guard case .rest(_) = params.parameterTypes[1] else { return XCTFail("Expected a rest parameter") }
+    }
+
+
     func testObjectLiteralBuilding() {
         let fuzzer = makeMockFuzzer()
         let b = fuzzer.makeBuilder()