Skip to content

Commit f0f491a

Browse files
LiedtkeV8-internal LUCI CQ
Liedtke
authored and
V8-internal LUCI CQ
committed
Fix some wrongly registered builtins
- Promise.all, Promise.race, Promise.allSettled expect a single (iterable) argument. - Date.now, Date.parse, Date.UTC don't return a Date, they return a number (the timestamp). The same applies to all the mutator / setter methods on Date.prototype. - String.prototype.localeCompare returns an integer, not a string. - String.prototype.match returns an array of matches, not a single string. - FinalizationRegistry.prototype.register doesn't return anything. - FinalizationRegistry.prototype.unregister returns a boolean (whether at least one cell was unregistered). - Reflect.getPrototypeOf, Reflect.isExtensible, and Reflect.ownKeys throw a TypeError if passed a primitive value, so type them as requiring an object. - DataView: The multi-byte getter and setter methods were missing the optional littleEndian boolean parameter. - Math.max and Math.min return a number (which might be NaN). - Object.assign, .defineProperty, .defineProperties and .freeze all return the object. - Array.fill, .reverse and .sort return the passed (modified) array. - The same is true for the typed arrays (Int8Array and friends). Change-Id: I1c96b03f3303aad8868a13102b6675126bcc3997 Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9087136 Reviewed-by: Michael Achenbach <machenbach@google.com> Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Michael Achenbach <machenbach@google.com>
1 parent 1cb9578 commit f0f491a

1 file changed

Lines changed: 57 additions & 57 deletions

File tree

‎Sources/Fuzzilli/Environment/JavaScriptEnvironment.swift‎

Lines changed: 57 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -1495,7 +1495,7 @@ public extension ObjectGroup {
14951495
"endsWith" : [.string, .opt(.integer)] => .boolean,
14961496
"indexOf" : [.jsAnything, .opt(.integer)] => .integer,
14971497
"lastIndexOf" : [.jsAnything, .opt(.integer)] => .integer,
1498-
"match" : [.regexp] => .jsString,
1498+
"match" : [.regexp] => .jsArray,
14991499
"matchAll" : [.regexp] => .jsIterator,
15001500
"normalize" : [] => .jsString, // the first parameter must be a specific string value, so we have a CodeGenerator for that instead
15011501
"padEnd" : [.integer, .opt(.string)] => .jsString,
@@ -1515,7 +1515,7 @@ public extension ObjectGroup {
15151515
"trimRight" : [] => .jsString,
15161516
"toLowerCase" : [] => .jsString,
15171517
"toUpperCase" : [] => .jsString,
1518-
"localeCompare" : [.string, .opt(.string), .opt(.object())] => .jsString,
1518+
"localeCompare" : [.string, .opt(.string), .opt(.object())] => .integer,
15191519
"anchor" : [.string] => .jsString,
15201520
"at" : [.integer] => .jsString,
15211521
"big" : [] => .jsString,
@@ -1571,7 +1571,7 @@ public extension ObjectGroup {
15711571
"copyWithin" : [.integer, .integer, .opt(.integer)] => .jsArray,
15721572
"entries" : [] => .jsIterator,
15731573
"every" : [.function(), .opt(.object())] => .boolean,
1574-
"fill" : [.jsAnything, .opt(.integer), .opt(.integer)] => .undefined,
1574+
"fill" : [.jsAnything, .opt(.integer), .opt(.integer)] => .jsArray,
15751575
"find" : [.function(), .opt(.object())] => .jsAnything,
15761576
"findIndex" : [.function(), .opt(.object())] => .integer,
15771577
"findLast" : [.function(), .opt(.object())] => .jsAnything,
@@ -1584,9 +1584,9 @@ public extension ObjectGroup {
15841584
"lastIndexOf" : [.jsAnything, .opt(.integer)] => .integer,
15851585
"reduce" : [.function(), .opt(.jsAnything)] => .jsAnything,
15861586
"reduceRight" : [.function(), .opt(.jsAnything)] => .jsAnything,
1587-
"reverse" : [] => .undefined,
1587+
"reverse" : [] => .jsArray,
15881588
"some" : [.function(), .opt(.jsAnything)] => .boolean,
1589-
"sort" : [.function()] => .undefined,
1589+
"sort" : [.function()] => .jsArray,
15901590
"values" : [] => .jsIterator,
15911591
"pop" : [] => .jsAnything,
15921592
"push" : [.jsAnything...] => .integer,
@@ -1893,8 +1893,8 @@ public extension ObjectGroup {
18931893
instanceType: .jsFinalizationRegistry,
18941894
properties: [:],
18951895
methods: [
1896-
"register" : [.object(), .jsAnything, .opt(.object())] => .object(),
1897-
"unregister" : [.jsAnything] => .undefined,
1896+
"register" : [.object(), .jsAnything, .opt(.object())] => .undefined,
1897+
"unregister" : [.jsAnything] => .boolean,
18981898
]
18991899
)
19001900

@@ -2025,10 +2025,10 @@ public extension ObjectGroup {
20252025
],
20262026
methods: [
20272027
"at" : [.integer] => .jsAnything,
2028-
"copyWithin" : [.integer, .integer, .opt(.integer)] => .undefined,
2028+
"copyWithin" : [.integer, .integer, .opt(.integer)] => .jsTypedArray(variant),
20292029
"entries" : [] => .jsIterator,
20302030
"every" : [.function(), .opt(.object())] => .boolean,
2031-
"fill" : [.jsAnything, .opt(.integer), .opt(.integer)] => .undefined,
2031+
"fill" : [.jsAnything, .opt(.integer), .opt(.integer)] => .jsTypedArray(variant),
20322032
"find" : [.function(), .opt(.object())] => .jsAnything,
20332033
"findIndex" : [.function(), .opt(.object())] => .integer,
20342034
"findLast" : [.function(), .opt(.object())] => .jsAnything,
@@ -2041,10 +2041,10 @@ public extension ObjectGroup {
20412041
"lastIndexOf" : [.jsAnything, .opt(.integer)] => .integer,
20422042
"reduce" : [.function(), .opt(.jsAnything)] => .jsAnything,
20432043
"reduceRight" : [.function(), .opt(.jsAnything)] => .jsAnything,
2044-
"reverse" : [] => .undefined,
2044+
"reverse" : [] => .jsTypedArray(variant),
20452045
"set" : [.object(), .opt(.integer)] => .undefined,
20462046
"some" : [.function(), .opt(.jsAnything)] => .boolean,
2047-
"sort" : [.function()] => .undefined,
2047+
"sort" : [.function()] => .jsTypedArray(variant),
20482048
"values" : [] => .jsIterator,
20492049
"filter" : [.function(), .opt(.object())] => .jsTypedArray(variant),
20502050
"map" : [.function(), .opt(.object())] => .jsTypedArray(variant),
@@ -2099,24 +2099,24 @@ public extension ObjectGroup {
20992099
methods: [
21002100
"getInt8" : [.integer] => .integer,
21012101
"getUint8" : [.integer] => .integer,
2102-
"getInt16" : [.integer] => .integer,
2103-
"getUint16" : [.integer] => .integer,
2104-
"getInt32" : [.integer] => .integer,
2105-
"getUint32" : [.integer] => .integer,
2106-
"getFloat16" : [.integer] => .float,
2107-
"getFloat32" : [.integer] => .float,
2108-
"getFloat64" : [.integer] => .float,
2102+
"getInt16" : [.integer, .opt(.boolean)] => .integer,
2103+
"getUint16" : [.integer, .opt(.boolean)] => .integer,
2104+
"getInt32" : [.integer, .opt(.boolean)] => .integer,
2105+
"getUint32" : [.integer, .opt(.boolean)] => .integer,
2106+
"getFloat16" : [.integer, .opt(.boolean)] => .float,
2107+
"getFloat32" : [.integer, .opt(.boolean)] => .float,
2108+
"getFloat64" : [.integer, .opt(.boolean)] => .float,
21092109
"getBigInt64" : [.integer, .opt(.boolean)] => .bigint,
21102110
"getBigUint64": [.integer, .opt(.boolean)] => .bigint,
21112111
"setInt8" : [.integer, .integer] => .undefined,
21122112
"setUint8" : [.integer, .integer] => .undefined,
2113-
"setInt16" : [.integer, .integer] => .undefined,
2114-
"setUint16" : [.integer, .integer] => .undefined,
2115-
"setInt32" : [.integer, .integer] => .undefined,
2116-
"setUint32" : [.integer, .integer] => .undefined,
2117-
"setFloat16" : [.integer, .float] => .undefined,
2118-
"setFloat32" : [.integer, .float] => .undefined,
2119-
"setFloat64" : [.integer, .float] => .undefined,
2113+
"setInt16" : [.integer, .integer, .opt(.boolean)] => .undefined,
2114+
"setUint16" : [.integer, .integer, .opt(.boolean)] => .undefined,
2115+
"setInt32" : [.integer, .integer, .opt(.boolean)] => .undefined,
2116+
"setUint32" : [.integer, .integer, .opt(.boolean)] => .undefined,
2117+
"setFloat16" : [.integer, .float, .opt(.boolean)] => .undefined,
2118+
"setFloat32" : [.integer, .float, .opt(.boolean)] => .undefined,
2119+
"setFloat64" : [.integer, .float, .opt(.boolean)] => .undefined,
21202120
"setBigInt64" : [.integer, .bigint, .opt(.boolean)] => .undefined,
21212121
"setBigUint64" : [.integer, .bigint, .opt(.boolean)] => .undefined,
21222122
]
@@ -2149,10 +2149,10 @@ public extension ObjectGroup {
21492149
methods: [
21502150
"resolve" : [.jsAnything] => .jsPromise,
21512151
"reject" : [.jsAnything] => .jsPromise,
2152-
"all" : [.jsPromise...] => .jsPromise,
2153-
"any" : [.jsPromise...] => .jsPromise,
2154-
"race" : [.jsPromise...] => .jsPromise,
2155-
"allSettled" : [.jsPromise...] => .jsPromise,
2152+
"all" : [.iterable] => .jsPromise,
2153+
"any" : [.iterable] => .jsPromise,
2154+
"race" : [.iterable] => .jsPromise,
2155+
"allSettled" : [.iterable] => .jsPromise,
21562156
"try" : [.function(), .jsAnything...] => .jsPromise,
21572157
"withResolvers": [] => .object(withProperties: ["promise", "resolve", "reject"]),
21582158
]
@@ -2189,22 +2189,22 @@ public extension ObjectGroup {
21892189
"getUTCMilliseconds" : [] => .number,
21902190
"getTimezoneOffset" : [] => .number,
21912191
"getYear" : [] => .number,
2192-
"setTime" : [.number] => .jsDate,
2193-
"setMilliseconds" : [.number] => .jsDate,
2194-
"setUTCMilliseconds" : [.number] => .jsDate,
2195-
"setSeconds" : [.number] => .jsDate,
2196-
"setUTCSeconds" : [.number, .opt(.number)] => .jsDate,
2197-
"setMinutes" : [.number, .opt(.number), .opt(.number)] => .jsDate,
2198-
"setUTCMinutes" : [.number, .opt(.number), .opt(.number)] => .jsDate,
2199-
"setHours" : [.number, .opt(.number), .opt(.number)] => .jsDate,
2200-
"setUTCHours" : [.number, .opt(.number), .opt(.number)] => .jsDate,
2201-
"setDate" : [.number] => .jsDate,
2202-
"setUTCDate" : [.number] => .jsDate,
2203-
"setMonth" : [.number] => .jsDate,
2204-
"setUTCMonth" : [.number] => .jsDate,
2205-
"setFullYear" : [.number, .opt(.number), .opt(.number)] => .jsDate,
2206-
"setUTCFullYear" : [.number, .opt(.number), .opt(.number)] => .jsDate,
2207-
"setYear" : [.number] => .jsDate,
2192+
"setTime" : [.number] => .number,
2193+
"setMilliseconds" : [.number] => .number,
2194+
"setUTCMilliseconds" : [.number] => .number,
2195+
"setSeconds" : [.number] => .number,
2196+
"setUTCSeconds" : [.number, .opt(.number)] => .number,
2197+
"setMinutes" : [.number, .opt(.number), .opt(.number)] => .number,
2198+
"setUTCMinutes" : [.number, .opt(.number), .opt(.number)] => .number,
2199+
"setHours" : [.number, .opt(.number), .opt(.number)] => .number,
2200+
"setUTCHours" : [.number, .opt(.number), .opt(.number)] => .number,
2201+
"setDate" : [.number] => .number,
2202+
"setUTCDate" : [.number] => .number,
2203+
"setMonth" : [.number] => .number,
2204+
"setUTCMonth" : [.number] => .number,
2205+
"setFullYear" : [.number, .opt(.number), .opt(.number)] => .number,
2206+
"setUTCFullYear" : [.number, .opt(.number), .opt(.number)] => .number,
2207+
"setYear" : [.number] => .number,
22082208
"toJSON" : [] => .jsString,
22092209
"toUTCString" : [] => .jsString,
22102210
"toGMTString" : [] => .jsString,
@@ -2223,9 +2223,9 @@ public extension ObjectGroup {
22232223
"prototype" : jsDatePrototype.instanceType
22242224
],
22252225
methods: [
2226-
"UTC" : [.number, .opt(.number), .opt(.number), .opt(.number), .opt(.number), .opt(.number), .opt(.number)] => .jsDate,
2227-
"now" : [] => .jsDate,
2228-
"parse" : [.string] => .jsDate,
2226+
"UTC" : [.number, .opt(.number), .opt(.number), .opt(.number), .opt(.number), .opt(.number), .opt(.number)] => .number,
2227+
"now" : [] => .number,
2228+
"parse" : [.string] => .number,
22292229
]
22302230
)
22312231

@@ -2238,12 +2238,12 @@ public extension ObjectGroup {
22382238
"prototype" : .object(), // TODO
22392239
],
22402240
methods: [
2241-
"assign" : [.object(), .object()] => .undefined,
2241+
"assign" : [.object(), .object()] => .object(),
22422242
"create" : [.object(), .object()] => .object(),
2243-
"defineProperty" : [.object(), .string, .oneof(.object(withProperties: ["configurable", "writable", "enumerable", "value"]), .object(withMethods: ["get", "set"]))] => .undefined,
2244-
"defineProperties" : [.object(), .object()] => .undefined,
2243+
"defineProperty" : [.object(), .string, .oneof(.object(withProperties: ["configurable", "writable", "enumerable", "value"]), .object(withMethods: ["get", "set"]))] => .object(),
2244+
"defineProperties" : [.object(), .object()] => .object(),
22452245
"entries" : [.object()] => .object(),
2246-
"freeze" : [.object()] => .undefined,
2246+
"freeze" : [.object()] => .object(),
22472247
"fromEntries" : [.object()] => .object(),
22482248
"getOwnPropertyDescriptor" : [.object(), .string] => .object(withProperties: ["configurable", "writable", "enumerable", "value"]),
22492249
"getOwnPropertyDescriptors" : [.object()] => .object(),
@@ -2475,8 +2475,8 @@ public extension ObjectGroup {
24752475
"log1p" : [.jsAnything] => .number,
24762476
"log10" : [.jsAnything] => .number,
24772477
"log2" : [.jsAnything] => .number,
2478-
"max" : [.jsAnything...] => .jsAnything,
2479-
"min" : [.jsAnything...] => .jsAnything,
2478+
"max" : [.jsAnything...] => .number,
2479+
"min" : [.jsAnything...] => .number,
24802480
"pow" : [.jsAnything, .jsAnything] => .number,
24812481
"random" : [] => .number,
24822482
"round" : [.jsAnything] => .number,
@@ -2544,10 +2544,10 @@ public extension ObjectGroup {
25442544
"deleteProperty" : [.object(), .string] => .boolean,
25452545
"get" : [.object(), .string, .opt(.object())] => .jsAnything,
25462546
"getOwnPropertyDescriptor" : [.object(), .string] => .jsAnything,
2547-
"getPrototypeOf" : [.jsAnything] => .jsAnything,
2547+
"getPrototypeOf" : [.object()] => .jsAnything,
25482548
"has" : [.object(), .string] => .boolean,
2549-
"isExtensible" : [.jsAnything] => .boolean,
2550-
"ownKeys" : [.jsAnything] => .jsArray,
2549+
"isExtensible" : [.object()] => .boolean,
2550+
"ownKeys" : [.object()] => .jsArray,
25512551
"preventExtensions" : [.object()] => .boolean,
25522552
"set" : [.object(), .string, .jsAnything, .opt(.object())] => .boolean,
25532553
"setPrototypeOf" : [.object(), .object()] => .boolean,

0 commit comments

Comments
 (0)