[environment] Add missing builtins to Error objects

Bug: 487347678
Change-Id: I649849a5e3d9511e82e5e47a5ffc61433ca8822e
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9058837
Reviewed-by: Danylo Mocherniuk <mdanylo@google.com>
Commit-Queue: Danylo Mocherniuk <mdanylo@google.com>

Author: Liedtke

Sources/Fuzzilli/Environment/JavaScriptEnvironment.swift

@@ -427,6 +427,8 @@ public class JavaScriptEnvironment: ComponentBase {
         registerObjectGroup(.jsSharedArrayBufferPrototype)
         for variant in ["Error", "EvalError", "RangeError", "ReferenceError", "SyntaxError", "TypeError", "AggregateError", "URIError", "SuppressedError"] {
             registerObjectGroup(.jsError(variant))
+            registerObjectGroup(.jsErrorPrototype(variant))
+            registerObjectGroup(.jsErrorConstructor(variant))
         }
         registerObjectGroup(.jsWebAssemblyCompileOptions)
         registerObjectGroup(.jsWebAssemblyModuleConstructor)
@@ -627,10 +629,9 @@ public class JavaScriptEnvironment: ComponentBase {
         registerBuiltin("Iterator", ofType: .jsIteratorConstructor)
         registerBuiltin("BigInt", ofType: .jsBigIntConstructor)
         registerBuiltin("RegExp", ofType: .jsRegExpConstructor)
-        for variant in ["Error", "EvalError", "RangeError", "ReferenceError", "SyntaxError", "TypeError", "URIError", "SuppressedError"] {
+        for variant in ["Error", "EvalError", "RangeError", "ReferenceError", "SyntaxError", "TypeError", "URIError", "SuppressedError", "AggregateError"] {
             registerBuiltin(variant, ofType: .jsErrorConstructor(variant))
         }
-        registerBuiltin("AggregateError", ofType: .functionAndConstructor([.plain(.iterable), .opt(.string), .opt(.object())] => .jsError("AggregateError")))
         registerBuiltin("ArrayBuffer", ofType: .jsArrayBufferConstructor)
         registerBuiltin("SharedArrayBuffer", ofType: .jsSharedArrayBufferConstructor)
         for variant in ["Uint8Array", "Int8Array", "Uint16Array", "Int16Array", "Uint32Array", "Int32Array", "Float16Array", "Float32Array", "Float64Array", "Uint8ClampedArray", "BigInt64Array", "BigUint64Array"] {
@@ -1197,8 +1198,16 @@ public extension ILType {
 
     /// Type of the JavaScript Error constructor builtin
     static func jsErrorConstructor(_ variant: String) -> ILType {
-        // TODO: Add `Error.isError()`
-        return .functionAndConstructor([.opt(.string)] => .jsError(variant))
+        let signature = if variant == "AggregateError" {
+            [.plain(.iterable), .opt(.string), .opt(.object())] => .jsError("AggregateError")
+        } else {
+            [.opt(.string)] => .jsError(variant)
+        }
+        return .functionAndConstructor(signature)
+            + .object(
+                ofGroup: "\(variant)Constructor",
+                withProperties: ["prototype", "stackTraceLimit"],
+                withMethods: ["isError", "captureStackTrace"])
     }
 
     /// Type of the JavaScript ArrayBuffer constructor builtin.
@@ -2498,6 +2507,26 @@ public extension ObjectGroup {
         )
     }
 
+    static func jsErrorPrototype(_ variant: String) -> ObjectGroup {
+        return createPrototypeObjectGroup(jsError(variant), constructor: .jsErrorConstructor(variant))
+    }
+
+    static func jsErrorConstructor(_ variant: String) -> ObjectGroup {
+        return ObjectGroup(
+            name: "\(variant)Constructor",
+            constructorPath: variant,
+            instanceType: .jsErrorConstructor(variant),
+            properties: [
+                "prototype": jsErrorPrototype(variant).instanceType,
+                "stackTraceLimit": .integer,
+            ],
+            methods: [
+                "isError": [.jsAnything] => .boolean,
+                "captureStackTrace": [.object(), .opt(.function())] => .undefined,
+            ]
+        )
+    }
+
     // TODO(mliedtke): We need to construct these to make code generators be able to provide
     // somewhat reasonable compile options.
     static let jsWebAssemblyCompileOptions = ObjectGroup(