Diversify argument patterns for optimized function generators

This diversifies the arguments for the function calls in V8's
typical function-optimization shortcuts.

Often, reproducers have an argument pattern across the functions
that is not all equal. For getting polymorphic feedback or a type
deviation in the optimized function call, we see patterns like:
f(a); f(a); %Opt(f); f(b);
Or:
f(a); f(b); %Opt(f); f(c);

Though Fuzzilli will eventually mutate the arguments, this change
attempts to tickle out this diversity a bit more.

With the largest percentage we retain the old behavior.

Change-Id: I58c8e7361aa3ce122a034417708dcedb8b4d7888
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9020237
Reviewed-by: Dominik Klemba <tacet@google.com>
Commit-Queue: Michael Achenbach <machenbach@google.com>

Author: mi-ac

Sources/FuzzilliCli/Profiles/V8CommonProfile.swift

@@ -73,40 +73,62 @@ public let ForceJITCompilationThroughLoopGenerator = CodeGenerator("ForceJITComp
     }
 }
 
+// Choose argument lists for four function calls of the same function with
+// interesting optimization patterns.
+func chooseArgumentLists(_ b: ProgramBuilder, forCalling f: Variable) -> ([Variable], [Variable], [Variable], [Variable]) {
+    var pool: [[Variable]?] = [nil, nil, nil]
+
+    let getArg = { (i: Int) -> [Variable] in
+        if pool[i] == nil {
+            pool[i] = b.randomArguments(forCalling: f)
+        }
+        return pool[i]!
+    }
+
+    let keepRates = [1.0, 0.97, 0.85, 0.75]
+
+    let args = (0..<4).map { i in
+        probability(keepRates[i]) ? getArg(0) : getArg(probability(0.5) ? 1 : 2)
+    }
+
+    assert(args.count == 4)
+    return (args[0], args[1], args[2], args[3])
+}
+
 public let ForceTurboFanCompilationGenerator = CodeGenerator("ForceTurboFanCompilationGenerator", inputs: .required(.function())) { b, f in
     assert(b.type(of: f).Is(.function()))
-    let arguments = b.randomArguments(forCalling: f)
+    let (args1, args2, args3, args4) = chooseArgumentLists(b, forCalling: f)
 
     let guardCalls = probability(0.5)
 
-    b.callFunction(f, withArgs: arguments, guard: guardCalls)
+    b.callFunction(f, withArgs: args1, guard: guardCalls)
 
     b.eval("%PrepareFunctionForOptimization(%@)", with: [f]);
 
-    b.callFunction(f, withArgs: arguments, guard: guardCalls)
-    b.callFunction(f, withArgs: arguments, guard: guardCalls)
+    b.callFunction(f, withArgs: args2, guard: guardCalls)
+    b.callFunction(f, withArgs: args3, guard: guardCalls)
 
     b.eval("%OptimizeFunctionOnNextCall(%@)", with: [f]);
 
-    b.callFunction(f, withArgs: arguments, guard: guardCalls)
+    b.callFunction(f, withArgs: args4, guard: guardCalls)
 }
 
 public let ForceMaglevCompilationGenerator = CodeGenerator("ForceMaglevCompilationGenerator", inputs: .required(.function())) { b, f in
     assert(b.type(of: f).Is(.function()))
-    let arguments = b.randomArguments(forCalling: f)
+    let (args1, args2, args3, args4) = chooseArgumentLists(b, forCalling: f)
 
     let guardCalls = probability(0.5)
 
-    b.callFunction(f, withArgs: arguments, guard: guardCalls)
+    b.callFunction(f, withArgs: args1, guard: guardCalls)
 
     b.eval("%PrepareFunctionForOptimization(%@)", with: [f]);
 
-    b.callFunction(f, withArgs: arguments, guard: guardCalls)
-    b.callFunction(f, withArgs: arguments, guard: guardCalls)
+    b.callFunction(f, withArgs: args2, guard: guardCalls)
+    b.callFunction(f, withArgs: args3, guard: guardCalls)
 
     b.eval("%OptimizeMaglevOnNextCall(%@)", with: [f]);
 
-    b.callFunction(f, withArgs: arguments, guard: guardCalls)
+    b.callFunction(f, withArgs: args4, guard: guardCalls)
 }
 
 public let TurbofanVerifyTypeGenerator = CodeGenerator("TurbofanVerifyTypeGenerator", inputs: .one) { b, v in