Create a structure-aware fuzzer (second try)

Cargo.toml

@@ -3,6 +3,7 @@ members = [
     "boa_cli",
     "boa_engine",
     "boa_gc",
+    "boa_inputgen",
     "boa_interner",
     "boa_profiler",
     "boa_tester",

boa_engine/Cargo.toml

@@ -27,7 +27,10 @@ intl = [
 # Enable Boa's WHATWG console object implementation.
 console = []
 
+fuzzer = ["arbitrary", "boa_interner/fuzzer", "num-bigint/arbitrary"]
+
 [dependencies]
+arbitrary = { version = "1", features = ["derive"], optional = true }
 boa_unicode = { path = "../boa_unicode", version = "0.15.0" }
 boa_interner = { path = "../boa_interner", version = "0.15.0" }
 boa_gc = { path = "../boa_gc", version = "0.15.0" }

boa_engine/src/context/mod.rs

@@ -99,6 +99,10 @@ pub struct Context {
     #[cfg(feature = "intl")]
     icu: icu::Icu,
 
+    /// The maximum number of instructions which will be executed in this context.
+    #[cfg(feature = "fuzzer")]
+    pub(crate) max_insns: usize,
+
     pub(crate) vm: Vm,
 
     pub(crate) promise_job_queue: VecDeque<JobCallback>,
@@ -776,6 +780,12 @@ impl Context {
         // TODO
         self.promise_job_queue.push_back(job);
     }
+
+    /// Set the maximum number of instructions for this context
+    #[cfg(feature = "fuzzer")]
+    pub fn set_max_insns(&mut self, max_insns: usize) {
+        self.max_insns = max_insns;
+    }
 }
 /// Builder for the [`Context`] type.
 ///
@@ -831,6 +841,8 @@ impl ContextBuilder {
             #[cfg(feature = "console")]
             console: Console::default(),
             intrinsics: Intrinsics::default(),
+            #[cfg(feature = "fuzzer")]
+            max_insns: 1 << 20,
             vm: Vm {
                 frames: Vec::with_capacity(16),
                 stack: Vec::with_capacity(1024),

boa_engine/src/lib.rs

@@ -15,6 +15,8 @@
     html_favicon_url = "https://raw.githubusercontent.com/boa-dev/boa/main/assets/logo.svg"
 )]
 #![cfg_attr(not(test), forbid(clippy::unwrap_used))]
+#![cfg_attr(feature = "fuzzer", allow(clippy::use_self))] // false-positive on derive(Arbitrary)
+#![cfg_attr(not(feature = "fuzzer"), deny(clippy::use_self))]
 #![warn(
     clippy::perf,
     clippy::single_match_else,

boa_engine/src/syntax/ast/constant.rs

@@ -24,6 +24,7 @@ use serde::{Deserialize, Serialize};
 /// [spec]: https://tc39.es/ecma262/#sec-primary-expression-literals
 /// [mdn]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Grammar_and_types#Literals
 #[cfg_attr(feature = "deser", derive(Serialize, Deserialize))]
+#[cfg_attr(feature = "fuzzer", derive(arbitrary::Arbitrary))]
 #[derive(Clone, Debug, Finalize, PartialEq)]
 pub enum Const {
     /// A string literal is zero or more characters enclosed in double (`"`) or single (`'`) quotation marks.

boa_engine/src/syntax/ast/node/array/mod.rs

@@ -26,10 +26,11 @@ mod tests;
 /// [spec]: https://tc39.es/ecma262/#prod-ArrayLiteral
 /// [mdn]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array
 #[cfg_attr(feature = "deser", derive(Serialize, Deserialize))]
+#[cfg_attr(feature = "fuzzer", derive(arbitrary::Arbitrary))]
 #[derive(Clone, Debug, PartialEq)]
 pub struct ArrayDecl {
-    arr: Box<[Node]>,
-    has_trailing_comma_spread: bool,
+    pub(crate) arr: Box<[Node]>,
+    pub(crate) has_trailing_comma_spread: bool,
 }
 
 impl ArrayDecl {

boa_engine/src/syntax/ast/node/await_expr/mod.rs

@@ -19,9 +19,10 @@ mod tests;
 /// [spec]: https://tc39.es/ecma262/#prod-AwaitExpression
 /// [mdn]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/await
 #[cfg_attr(feature = "deser", derive(Serialize, Deserialize))]
+#[cfg_attr(feature = "fuzzer", derive(arbitrary::Arbitrary))]
 #[derive(Clone, Debug, PartialEq)]
 pub struct AwaitExpr {
-    expr: Box<Node>,
+    pub(crate) expr: Box<Node>,
 }
 
 impl AwaitExpr {

boa_engine/src/syntax/ast/node/block/mod.rs

@@ -25,11 +25,12 @@ mod tests;
 /// [spec]: https://tc39.es/ecma262/#prod-BlockStatement
 /// [mdn]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/block
 #[cfg_attr(feature = "deser", derive(Serialize, Deserialize))]
+#[cfg_attr(feature = "fuzzer", derive(arbitrary::Arbitrary))]
 #[cfg_attr(feature = "deser", serde(transparent))]
 #[derive(Clone, Debug, PartialEq)]
 pub struct Block {
     #[cfg_attr(feature = "deser", serde(flatten))]
-    statements: StatementList,
+    pub(crate) statements: StatementList,
 }
 
 impl Block {

boa_engine/src/syntax/ast/node/call/mod.rs

@@ -22,10 +22,11 @@ mod tests;
 /// [spec]: https://tc39.es/ecma262/#prod-CallExpression
 /// [mdn]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Functions#Calling_functions
 #[cfg_attr(feature = "deser", derive(Serialize, Deserialize))]
+#[cfg_attr(feature = "fuzzer", derive(arbitrary::Arbitrary))]
 #[derive(Clone, Debug, PartialEq)]
 pub struct Call {
-    expr: Box<Node>,
-    args: Box<[Node]>,
+    pub(crate) expr: Box<Node>,
+    pub(crate) args: Box<[Node]>,
 }
 
 impl Call {

boa_engine/src/syntax/ast/node/conditional/conditional_op/mod.rs

@@ -19,11 +19,12 @@ use serde::{Deserialize, Serialize};
 /// [spec]: https://tc39.es/ecma262/#prod-ConditionalExpression
 /// [mdn]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Grammar_and_types#Literals
 #[cfg_attr(feature = "deser", derive(Serialize, Deserialize))]
+#[cfg_attr(feature = "fuzzer", derive(arbitrary::Arbitrary))]
 #[derive(Clone, Debug, PartialEq)]
 pub struct ConditionalOp {
-    condition: Box<Node>,
-    if_true: Box<Node>,
-    if_false: Box<Node>,
+    pub(crate) condition: Box<Node>,
+    pub(crate) if_true: Box<Node>,
+    pub(crate) if_false: Box<Node>,
 }
 
 impl ConditionalOp {

boa_engine/src/syntax/ast/node/conditional/if_node/mod.rs

@@ -21,11 +21,12 @@ use serde::{Deserialize, Serialize};
 /// [falsy]: https://developer.mozilla.org/en-US/docs/Glossary/falsy
 /// [expression]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Expressions_and_Operators#Expressions
 #[cfg_attr(feature = "deser", derive(Serialize, Deserialize))]
+#[cfg_attr(feature = "fuzzer", derive(arbitrary::Arbitrary))]
 #[derive(Clone, Debug, PartialEq)]
 pub struct If {
-    cond: Box<Node>,
-    body: Box<Node>,
-    else_node: Option<Box<Node>>,
+    pub(crate) cond: Box<Node>,
+    pub(crate) body: Box<Node>,
+    pub(crate) else_node: Option<Box<Node>>,
 }
 
 impl If {
@@ -56,11 +57,7 @@ impl If {
         }
     }
 
-    pub(in crate::syntax::ast::node) fn to_indented_string(
-        &self,
-        interner: &Interner,
-        indent: usize,
-    ) -> String {
+    pub(crate) fn to_indented_string(&self, interner: &Interner, indent: usize) -> String {
         let mut buf = format!("if ({}) ", self.cond().to_interned_string(interner));
         match self.else_node() {
             Some(else_e) => {

boa_engine/src/syntax/ast/node/declaration/arrow_function_decl/mod.rs

@@ -18,11 +18,12 @@ use serde::{Deserialize, Serialize};
 /// [spec]: https://tc39.es/ecma262/#prod-ArrowFunction
 /// [mdn]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Functions/Arrow_functions
 #[cfg_attr(feature = "deser", derive(Serialize, Deserialize))]
+#[cfg_attr(feature = "fuzzer", derive(arbitrary::Arbitrary))]
 #[derive(Clone, Debug, PartialEq)]
 pub struct ArrowFunctionDecl {
-    name: Option<Sym>,
-    params: FormalParameterList,
-    body: StatementList,
+    pub(crate) name: Option<Sym>,
+    pub(crate) params: FormalParameterList,
+    pub(crate) body: StatementList,
 }
 
 impl ArrowFunctionDecl {
@@ -61,11 +62,7 @@ impl ArrowFunctionDecl {
     }
 
     /// Implements the display formatting with indentation.
-    pub(in crate::syntax::ast::node) fn to_indented_string(
-        &self,
-        interner: &Interner,
-        indentation: usize,
-    ) -> String {
+    pub(crate) fn to_indented_string(&self, interner: &Interner, indentation: usize) -> String {
         let mut buf = format!("({}", join_nodes(interner, &self.params.parameters));
         if self.body().items().is_empty() {
             buf.push_str(") => {}");

boa_engine/src/syntax/ast/node/declaration/async_function_decl/mod.rs

@@ -15,11 +15,12 @@ use serde::{Deserialize, Serialize};
 /// [spec]: https://tc39.es/ecma262/#sec-async-function-prototype-properties
 /// [mdn]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/async_function
 #[cfg_attr(feature = "deser", derive(Serialize, Deserialize))]
+#[cfg_attr(feature = "fuzzer", derive(arbitrary::Arbitrary))]
 #[derive(Clone, Debug, PartialEq)]
 pub struct AsyncFunctionDecl {
-    name: Sym,
-    parameters: FormalParameterList,
-    body: StatementList,
+    pub(crate) name: Sym,
+    pub(crate) parameters: FormalParameterList,
+    pub(crate) body: StatementList,
 }
 
 impl AsyncFunctionDecl {
@@ -52,11 +53,7 @@ impl AsyncFunctionDecl {
     }
 
     /// Implements the display formatting with indentation.
-    pub(in crate::syntax::ast::node) fn to_indented_string(
-        &self,
-        interner: &Interner,
-        indentation: usize,
-    ) -> String {
+    pub(crate) fn to_indented_string(&self, interner: &Interner, indentation: usize) -> String {
         let mut buf = format!(
             "async function {}({}",
             interner.resolve_expect(self.name),