[environment] Register Intl.DisplayNames and its builtins

and add a custom generator for Intl.DisplayNames.prototype.of() as it
contains a tight coupling between the constructor arguments and the code
provided to the "of" function as an argument.

Bug: 487347678
Change-Id: Ia0ffd3f51599b501a6855b07931249abcf777984
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9063878
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Manish Goregaokar <manishearth@google.com>

Author: Liedtke

Sources/Fuzzilli/Base/ProgramBuilder.swift

@@ -5019,22 +5019,28 @@ public class ProgramBuilder {
     // so we instead register a generator that allows the fuzzer a greater chance of generating
     // one when needed.
     //
-    // These can be registered on the JavaScriptEnvironment with addProducingGenerator()
+    // These can be registered on the JavaScriptEnvironment with addProducingGenerator().
+    // argument `predefined`: Provide values that should be used for the given properties of the
+    //   options bag (if present) instead of finding or generating random values for them. The
+    //   property might still be filtered out.
     @discardableResult
-    func createOptionsBag(_ bag: OptionsBag) -> Variable {
+    func createOptionsBag(_ bag: OptionsBag, predefined: [String: Variable] = [:]) -> Variable {
         // We run .filter() to pick a subset of fields, but we generally want to set as many as possible
         // and let the mutator prune things
-        let dict: [String : Variable] = bag.properties.filter {_ in probability(0.8)}.mapValues {
-            if $0.isEnumeration {
-                return loadEnum($0)
+        let dict = [String : Variable](uniqueKeysWithValues: bag.properties.filter {_ in probability(0.8)}.map {
+            let (propertyName, type) = $0
+            if let predefinedVar = predefined[propertyName] {
+                return (propertyName, predefinedVar)
+            } else if type.isEnumeration {
+                return (propertyName, loadEnum(type))
             // relativeTo doesn't have an ObjectGroup so we cannot just register a producingGenerator for it
-            } else if $0.Is(OptionsBag.jsTemporalRelativeTo) {
-                return findOrGenerateType(chooseUniform(from: [.jsTemporalZonedDateTime, .jsTemporalPlainDateTime,
-                                          .jsTemporalPlainDate, .string]))
+            } else if type.Is(OptionsBag.jsTemporalRelativeTo) {
+                return (propertyName, findOrGenerateType(chooseUniform(from: [.jsTemporalZonedDateTime, .jsTemporalPlainDateTime,
+                                          .jsTemporalPlainDate, .string])))
             } else {
-                return findOrGenerateType($0)
+                return (propertyName, findOrGenerateType(type))
             }
-        }
+        })
         return createObject(with: dict)
     }
 
@@ -5403,6 +5409,29 @@ public class ProgramBuilder {
     fileprivate static let allScripts = ["Adlm", "Afak", "Aghb", "Ahom", "Arab", "Aran", "Armi", "Armn", "Avst", "Bali", "Bamu", "Bass", "Batk", "Beng", "Berf", "Bhks", "Blis", "Bopo", "Brah", "Brai", "Bugi", "Buhd", "Cakm", "Cans", "Cari", "Cham", "Cher", "Chis", "Chrs", "Cirt", "Copt", "Cpmn", "Cprt", "Cyrl", "Cyrs", "Deva", "Diak", "Dogr", "Dsrt", "Dupl", "Egyd", "Egyh", "Egyp", "Elba", "Elym", "Ethi", "Gara", "Geok", "Geor", "Glag", "Gong", "Gonm", "Goth", "Gran", "Grek", "Gujr", "Gukh", "Guru", "Hanb", "Hang", "Hani", "Hano", "Hans", "Hant", "Hatr", "Hebr", "Hira", "Hluw", "Hmng", "Hmnp", "Hntl", "Hrkt", "Hung", "Inds", "Ital", "Jamo", "Java", "Jpan", "Jurc", "Kali", "Kana", "Kawi", "Khar", "Khmr", "Khoj", "Kitl", "Kits", "Knda", "Kore", "Kpel", "Krai", "Kthi", "Lana", "Laoo", "Latf", "Latg", "Latn", "Leke", "Lepc", "Limb", "Lina", "Linb", "Lisu", "Loma", "Lyci", "Lydi", "Mahj", "Maka", "Mand", "Mani", "Marc", "Maya", "Medf", "Mend", "Merc", "Mero", "Mlym", "Modi", "Mong", "Moon", "Mroo", "Mtei", "Mult", "Mymr", "Nagm", "Nand", "Narb", "Nbat", "Newa", "Nkdb", "Nkgb", "Nkoo", "Nshu", "Ogam", "Olck", "Onao", "Orkh", "Orya", "Osge", "Osma", "Ougr", "Palm", "Pauc", "Pcun", "Pelm", "Perm", "Phag", "Phli", "Phlp", "Phlv", "Phnx", "Piqd", "Plrd", "Prti", "Psin", "Qaaa-Qabx", "Ranj", "Rjng", "Rohg", "Roro", "Runr", "Samr", "Sara", "Sarb", "Saur", "Seal", "Sgnw", "Shaw", "Shrd", "Shui", "Sidd", "Sidt", "Sind", "Sinh", "Sogd", "Sogo", "Sora", "Soyo", "Sund", "Sunu", "Sylo", "Syrc", "Syre", "Syrj", "Syrn", "Tagb", "Takr", "Tale", "Talu", "Taml", "Tang", "Tavt", "Tayo", "Telu", "Teng", "Tfng", "Tglg", "Thaa", "Thai", "Tibt", "Tirh", "Tnsa", "Todr", "Tols", "Toto", "Tutg", "Ugar", "Vaii", "Visp", "Vith", "Wara", "Wcho", "Wole", "Xpeo", "Xsux", "Yezi", "Yiii", "Zanb", "Zinh", "Zmth", "Zsye", "Zsym", "Zxxx", "Zyyy", "Zzzz"]
     fileprivate static let allAlpha = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
     fileprivate static let allAlphaNum = allAlpha + "0123456789"
+    fileprivate static let allRegionsTwoDigit = [
+        "AD", "AE", "AF", "AG", "AI", "AL", "AM", "AO", "AQ", "AR", "AS", "AT",
+        "AU", "AW", "AX", "AZ", "BA", "BB", "BD", "BE", "BF", "BG", "BH", "BI",
+        "BJ", "BL", "BM", "BN", "BO", "BQ", "BR", "BS", "BT", "BV", "BW", "BY",
+        "BZ", "CA", "CC", "CD", "CF", "CG", "CH", "CI", "CK", "CL", "CM", "CN",
+        "CO", "CR", "CU", "CV", "CW", "CX", "CY", "CZ", "DE", "DJ", "DK", "DM",
+        "DO", "DZ", "EC", "EE", "EG", "EH", "ER", "ES", "ET", "FI", "FJ", "FK",
+        "FM", "FO", "FR", "GA", "GB", "GD", "GE", "GF", "GG", "GH", "GI", "GL",
+        "GM", "GN", "GP", "GQ", "GR", "GS", "GT", "GU", "GW", "GY", "HK", "HM",
+        "HN", "HR", "HT", "HU", "ID", "IE", "IL", "IM", "IN", "IO", "IQ", "IR",
+        "IS", "IT", "JE", "JM", "JO", "JP", "KE", "KG", "KH", "KI", "KM", "KN",
+        "KP", "KR", "KW", "KY", "KZ", "LA", "LB", "LC", "LI", "LK", "LR", "LS",
+        "LT", "LU", "LV", "LY", "MA", "MC", "MD", "ME", "MF", "MG", "MH", "MK",
+        "ML", "MM", "MN", "MO", "MP", "MQ", "MR", "MS", "MT", "MU", "MV", "MW",
+        "MX", "MY", "MZ", "NA", "NC", "NE", "NF", "NG", "NI", "NL", "NO", "NP",
+        "NR", "NU", "NZ", "OM", "PA", "PE", "PF", "PG", "PH", "PK", "PL", "PM",
+        "PN", "PR", "PS", "PT", "PW", "PY", "QA", "RE", "RO", "RS", "RU", "RW",
+        "SA", "SB", "SC", "SD", "SE", "SG", "SH", "SI", "SJ", "SK", "SL", "SM",
+        "SN", "SO", "SR", "SS", "ST", "SV", "SX", "SY", "SZ", "TC", "TD", "TF",
+        "TG", "TH", "TJ", "TK", "TL", "TM", "TN", "TO", "TR", "TT", "TV", "TW",
+        "TZ", "UA", "UG", "UM", "US", "UY", "UZ", "VA", "VC", "VE", "VG", "VI",
+        "VN", "VU", "WF", "WS", "YE", "YT", "ZA", "ZM", "ZW",
+    ]
 
     @discardableResult
     static func constructIntlUnit() -> String {
@@ -5429,7 +5458,7 @@ public class ProgramBuilder {
     static func constructIntlRegionString() -> String {
         // either two letters or three digits
         if probability(0.5) {
-            return String((0..<2).map { _ in allAlpha.randomElement()! })
+            return allRegionsTwoDigit.randomElement()!
         } else {
             return String(format: "%03d", Int.random(in: 0...999))
         }
@@ -5495,6 +5524,11 @@ public class ProgramBuilder {
         return constructIntlType(type: "Collator", optionsBag: .jsIntlCollatorSettings)
     }
 
+    @discardableResult
+    func constructIntlDisplayNames() -> Variable {
+        return constructIntlType(type: "DisplayNames", optionsBag: .jsIntlDisplayNamesSettings)
+    }
+
     @discardableResult
     func constructIntlListFormat() -> Variable {
         return constructIntlType(type: "ListFormat", optionsBag: .jsIntlListFormatSettings)

Sources/Fuzzilli/CodeGen/CodeGenerators.swift

@@ -12,6 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+import Foundation
+
 // Generator stubs for disposable and async-disposable object variables.
 func disposableObjVariableGeneratorStubs(
         inContext contextRequirement : Context,
@@ -351,7 +353,47 @@ public let CodeGenerators: [CodeGenerator] = [
     },
 
     CodeGenerator("BuiltinIntlGenerator") { b in
-        let _ = chooseUniform(from: [b.constructIntlDateTimeFormat, b.constructIntlCollator, b.constructIntlListFormat, b.constructIntlLocale, b.constructIntlNumberFormat, b.constructIntlPluralRules, b.constructIntlRelativeTimeFormat, b.constructIntlSegmenter])()
+        let _ = chooseUniform(from: [
+            b.constructIntlDateTimeFormat,
+            b.constructIntlCollator,
+            b.constructIntlListFormat,
+            b.constructIntlLocale,
+            b.constructIntlNumberFormat,
+            b.constructIntlPluralRules,
+            b.constructIntlRelativeTimeFormat,
+            b.constructIntlSegmenter,
+            b.constructIntlDisplayNames,
+            { // Fuzz Intl.DisplayNames.prototype.of()
+                let intl = b.createNamedVariable(forBuiltin: "Intl")
+                let ctor = b.getProperty("DisplayNames", of: intl)
+                let types =
+                    b.fuzzer.environment.getEnum(ofName: "IntlDisplayNamesTypeEnum")!.enumValues
+                let type = types.randomElement()!
+                let locale = b.loadString(ProgramBuilder.constructIntlLocaleString())
+                let options = b.createOptionsBag(.jsIntlDisplayNamesSettings,
+                    predefined: ["type": b.loadString(type)])
+                b.construct(ctor, withArgs: [locale, options])
+                let code = switch type {
+                    case "language":
+                        ProgramBuilder.constructIntlLanguageString()
+                    case "region":
+                        ProgramBuilder.constructIntlRegionString()
+                    case "script":
+                        ProgramBuilder.constructIntlScriptString()
+                    case "currency":
+                        Locale.commonISOCurrencyCodes.randomElement()!
+                    case "calendar":
+                        b.fuzzer.environment.getEnum(ofName: "temporalCalendar")!.enumValues
+                            .randomElement()!
+                    case "dateTimeField":
+                        ["era", "year", "quarter", "month", "weekOfYear", "weekday", "day",
+                         "dayPeriod", "hour", "minute", "second", "timeZoneName"].randomElement()!
+                    default:
+                        String.random(ofLength: 4)
+                }
+                return b.callMethod("of", on: ctor, withArgs: [b.loadString(code)])
+            }
+        ])()
     },
 
     CodeGenerator("HexGenerator") { b in

Sources/Fuzzilli/Environment/JavaScriptEnvironment.swift

@@ -483,6 +483,9 @@ public class JavaScriptEnvironment: ComponentBase {
         registerObjectGroup(.jsIntlCollator)
         registerObjectGroup(.jsIntlCollatorConstructor)
         registerObjectGroup(.jsIntlCollatorPrototype)
+        registerObjectGroup(.jsIntlDisplayNames)
+        registerObjectGroup(.jsIntlDisplayNamesConstructor)
+        registerObjectGroup(.jsIntlDisplayNamesPrototype)
         registerObjectGroup(.jsIntlDateTimeFormat)
         registerObjectGroup(.jsIntlDateTimeFormatConstructor)
         registerObjectGroup(.jsIntlDateTimeFormatPrototype)
@@ -538,6 +541,9 @@ public class JavaScriptEnvironment: ComponentBase {
         registerEnumeration(OptionsBag.jsIntlCollationTypeEnum)
         registerEnumeration(OptionsBag.jsIntlCaseFirstEnum)
         registerEnumeration(OptionsBag.jsIntlCollatorSensitivityEnum)
+        registerEnumeration(OptionsBag.jsIntlDisplayNamesTypeEnum)
+        registerEnumeration(OptionsBag.jsIntlDisplayNamesFallbackEnum)
+        registerEnumeration(OptionsBag.jsIntlDisplayNamesLanguageDisplayEnum)
         registerEnumeration(OptionsBag.jsIntlListFormatTypeEnum)
         registerEnumeration(OptionsBag.jsIntlNumberFormatStyleEnum)
         registerEnumeration(OptionsBag.jsIntlCurrencySystemEnum)
@@ -570,6 +576,7 @@ public class JavaScriptEnvironment: ComponentBase {
         registerOptionsBag(.jsTemporalPlainDateToZDTSettings)
         registerOptionsBag(.jsIntlDateTimeFormatSettings)
         registerOptionsBag(.jsIntlCollatorSettings)
+        registerOptionsBag(.jsIntlDisplayNamesSettings)
         registerOptionsBag(.jsIntlListFormatSettings)
         registerOptionsBag(.jsIntlLocaleSettings)
         registerOptionsBag(.jsIntlNumberFormatSettings)
@@ -3433,14 +3440,17 @@ extension OptionsBag {
 // Intl
 extension ILType {
     // Intl types
-    static let jsIntlObject = ILType.object(ofGroup: "Intl", withProperties: ["DateTimeFormat", "Collator", "ListFormat", "Locale", "NumberFormat", "PluralRules", "RelativeTimeFormat", "Segmenter"], withMethods: ["getCanonicalLocales", "supportedValuesOf"])
+    static let jsIntlObject = ILType.object(ofGroup: "Intl", withProperties: ["DateTimeFormat", "Collator", "DisplayNames", "ListFormat", "Locale", "NumberFormat", "PluralRules", "RelativeTimeFormat", "Segmenter"], withMethods: ["getCanonicalLocales", "supportedValuesOf"])
 
     static let jsIntlLocale = ILType.object(ofGroup: "Intl.Locale", withProperties: ["baseName", "calendar", "caseFirst", "collation", "hourCycle", "language", "numberingSystem", "numeric", "region", "script", "variants"], withMethods: ["getCalendars", "getCollations", "getHourCycles", "getNumberingSystems", "getTextInfo", "getTimeZones", "getWeekInfo", "maximize", "minimize", "toString"])
     static let jsIntlLocaleConstructor = ILType.functionAndConstructor([.plain(.jsIntlLocaleString), .opt(OptionsBag.jsIntlLocaleSettings.group.instanceType)] => .jsIntlLocale) + .object(ofGroup: "IntlLocaleConstructor", withProperties: ["prototype"], withMethods: [])
 
     static let jsIntlCollator = ILType.object(ofGroup: "Intl.Collator", withProperties: [], withMethods: ["compare", "resolvedOptions"])
     static let jsIntlCollatorConstructor = ILType.functionAndConstructor([.opt(.jsIntlLocaleLike), .opt(OptionsBag.jsIntlCollatorSettings.group.instanceType)] => .jsIntlCollator) + .object(ofGroup: "IntlCollatorConstructor", withProperties: ["prototype"], withMethods: ["supportedLocalesOf"])
 
+    static let jsIntlDisplayNames = ILType.object(ofGroup: "Intl.DisplayNames", withProperties: [], withMethods: ["of", "resolvedOptions"])
+    static let jsIntlDisplayNamesConstructor = ILType.functionAndConstructor([.plain(.jsIntlLocaleLike), .plain(OptionsBag.jsIntlDisplayNamesSettings.group.instanceType)] => .jsIntlDisplayNames) + .object(ofGroup: "IntlDisplayNamesConstructor", withProperties: ["prototype"], withMethods: ["supportedLocalesOf"])
+
     static let jsIntlDateTimeFormat = ILType.object(ofGroup: "Intl.DateTimeFormat", withProperties: [], withMethods: ["format", "formatRange", "formatRangeToParts", "formatToParts", "resolvedOptions"])
     static let jsIntlDateTimeFormatConstructor = ILType.functionAndConstructor([.opt(.jsIntlLocaleLike), .opt(OptionsBag.jsIntlDateTimeFormatSettings.group.instanceType)] => .jsIntlDateTimeFormat) + .object(ofGroup: "IntlDateTimeFormatConstructor", withProperties: ["prototype"], withMethods: ["supportedLocalesOf"])
 
@@ -3480,6 +3490,7 @@ extension ObjectGroup {
         properties: [
             "Collator"  : .jsIntlCollatorConstructor,
             "DateTimeFormat"  : .jsIntlDateTimeFormatConstructor,
+            "DisplayNames"  : .jsIntlDisplayNamesConstructor,
             "ListFormat"  : .jsIntlListFormatConstructor,
             "Locale"  : .jsIntlLocaleConstructor,
             "NumberFormat"  : .jsIntlNumberFormatConstructor,
@@ -3523,6 +3534,33 @@ extension ObjectGroup {
         ]
     )
 
+    static let jsIntlDisplayNames = ObjectGroup(
+        name: "Intl.DisplayNames",
+        instanceType: .jsIntlDisplayNames,
+        properties: [:],
+        methods: [
+            "of": [.string] => .string,  // TODO(mliedtke): The parameter should be typed more precise than string.
+            "resolvedOptions": [] => .object(withProperties: ["locale", "style", "type", "fallback", "languageDisplay"]),
+        ]
+    )
+
+    static let jsIntlDisplayNamesPrototype = createPrototypeObjectGroup(
+        jsIntlDisplayNames,
+        constructor: .jsIntlDisplayNamesConstructor)
+
+    static let jsIntlDisplayNamesConstructor = ObjectGroup(
+        name: "IntlDisplayNamesConstructor",
+        constructorPath: "Intl.DisplayNames",
+        instanceType: .jsIntlDisplayNamesConstructor,
+        properties: [
+            "prototype" : jsIntlDisplayNamesPrototype.instanceType
+        ],
+        methods: [
+            // TODO(manishearth) this also accepts arrays of locale-likes
+            "supportedLocalesOf": [.opt(.jsIntlLocaleLike), .opt(OptionsBag.jsIntlLocaleMatcherSettings.group.instanceType)] => .jsArray,
+        ]
+    )
+
     fileprivate static func dateTimeFormatSignature(_ returnType: ILType) -> [Signature] {
         // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Intl/DateTimeFormat/format#date
         // No ZonedDateTime as stated in the docs.
@@ -3799,6 +3837,9 @@ extension OptionsBag {
     fileprivate static let jsIntlCollationTypeEnum = ILType.enumeration(ofName: "IntlCollationType", withValues: ["compat", "emoji", "eor", "phonebk", "pinyin", "searchjl", "stroke", "trad", "unihan", "zhuyin"])
     fileprivate static let jsIntlCaseFirstEnum = ILType.enumeration(ofName: "IntlCaseFirst", withValues: ["upper", "lower", "false"])
     fileprivate static let jsIntlCollatorSensitivityEnum = ILType.enumeration(ofName: "IntlCollatorSensitivity", withValues: ["base", "accent", "case", "variant"])
+    fileprivate static let jsIntlDisplayNamesTypeEnum = ILType.enumeration(ofName: "IntlDisplayNamesTypeEnum", withValues: ["language", "region", "script", "currency", "calendar", "dateTimeField"])
+    fileprivate static let jsIntlDisplayNamesFallbackEnum = ILType.enumeration(ofName: "IntlDisplayNamesFallbackEnum", withValues: ["code", "none"])
+    fileprivate static let jsIntlDisplayNamesLanguageDisplayEnum = ILType.enumeration(ofName: "IntlDisplayNamesLanguageDisplayEnum", withValues: ["dialect", "standard"])
     fileprivate static let jsIntlListFormatTypeEnum = ILType.enumeration(ofName: "IntlListFormatTypeEnum", withValues: ["conjunction", "disjunction", "unit"])
     fileprivate static let jsIntlNumberFormatStyleEnum = ILType.enumeration(ofName: "IntlNumberFormatStyleEnum", withValues: ["decimal", "currency", "percent", "unit"])
     fileprivate static let jsIntlCurrencySystemEnum = ILType.enumeration(ofName: "IntlCurrency", withValues: Locale.Currency.isoCurrencies.map { $0.identifier })
@@ -3857,6 +3898,18 @@ extension OptionsBag {
         ]
     )
 
+    // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Intl/DisplayNames/DisplayNames#options
+    static let jsIntlDisplayNamesSettings = OptionsBag(
+        name: "IntlDisplayNamesSettings",
+        properties: [
+            "localeMatcher": jsIntlLocaleMatcherEnum,
+            "style": jsIntlLongShortNarrowEnum,
+            "type": jsIntlDisplayNamesTypeEnum,
+            "fallback": jsIntlDisplayNamesFallbackEnum,
+            "languageDisplay": jsIntlDisplayNamesLanguageDisplayEnum,
+        ]
+    )
+
     // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Intl/ListFormat/ListFormat#options
     static let jsIntlListFormatSettings = OptionsBag(
         name: "IntlListFormatSettings",