[general] Extend OptionsBag with mode for picking only 1 option

This CL adds the `selectionMode` property to the `OptionsBag` struct to
configure how `OptionsBag` selects the properties for the object literal
it generates. The default behavior is preserved with the `anySubset`
case. The new `exactlyOne` case configures `OptionsBag` to select
exactly one property for the object literal.

This CL also makes  `OptionsBag` easily usable in profiles by adding an
`additionalOptionsBag` property to the `Profile` struct and by removing
the strict assert on the supported `OptionsBag` properties array.

Bug: 512875834
Change-Id: I6b6348f515cc736ee281af9c9e384ac93eaf762c
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9311541
Commit-Queue: Tigran Bantikyan <bantikyan@google.com>
Reviewed-by: Matthias Liedtke <mliedtke@google.com>

Author: tbantikyan

Sources/Fuzzilli/Base/ProgramBuilder.swift

@@ -6588,30 +6588,36 @@ public class ProgramBuilder {
     //   property might still be filtered out.
     @discardableResult
     func createOptionsBag(_ bag: OptionsBag, predefined: [String: Variable] = [:]) -> Variable {
-        // We run .filter() to pick a subset of fields, but we generally want to set as many as possible
-        // and let the mutator prune things
-        let dict = [String: Variable](
-            uniqueKeysWithValues: bag.properties.filter { _ in probability(0.8) }.map {
-                let (propertyName, type) = $0
-                if let predefinedVar = predefined[propertyName] {
-                    return (propertyName, predefinedVar)
-                } else if type.isEnumeration {
-                    return (propertyName, loadEnum(type))
-                    // relativeTo doesn't have an ObjectGroup so we cannot just register a producingGenerator for it
-                } else if type.Is(OptionsBag.jsTemporalRelativeTo) {
-                    return (
-                        propertyName,
-                        findOrGenerateType(
-                            chooseUniform(from: [
-                                .jsTemporalZonedDateTime, .jsTemporalPlainDateTime,
-                                .jsTemporalPlainDate, .string,
-                            ]))
-                    )
-                } else {
-                    return (propertyName, findOrGenerateType(type))
-                }
-            })
-        return createObject(with: dict)
+        switch bag.selectionMode {
+        case .anySubset:
+            // We run .filter() to pick a subset of fields, but we generally want to set as many as possible
+            // and let the mutator prune things
+            let dict = [String: Variable](
+                uniqueKeysWithValues: bag.properties.filter { _ in probability(0.8) }.map {
+                    let (propertyName, type) = $0
+                    if let predefinedVar = predefined[propertyName] {
+                        return (propertyName, predefinedVar)
+                    } else if type.isEnumeration {
+                        return (propertyName, loadEnum(type))
+                        // relativeTo doesn't have an ObjectGroup so we cannot just register a producingGenerator for it
+                    } else if type.Is(OptionsBag.jsTemporalRelativeTo) {
+                        return (
+                            propertyName,
+                            findOrGenerateType(
+                                chooseUniform(from: [
+                                    .jsTemporalZonedDateTime, .jsTemporalPlainDateTime,
+                                    .jsTemporalPlainDate, .string,
+                                ]))
+                        )
+                    } else {
+                        return (propertyName, findOrGenerateType(type))
+                    }
+                })
+            return createObject(with: dict)
+        case .exactlyOne:
+            let (propertyName, type) = bag.properties.randomElement()!
+            return createObject(with: [propertyName: findOrGenerateType(type)])
+        }
     }
 
     // Generate a Temporal.Duration object

Sources/Fuzzilli/Environment/JavaScriptEnvironment.swift

@@ -357,7 +357,7 @@ public class JavaScriptEnvironment: ComponentBase {
 
     public init(
         additionalBuiltins: [String: ILType] = [:], additionalObjectGroups: [ObjectGroup] = [],
-        additionalEnumerations: [ILType] = []
+        additionalEnumerations: [ILType] = [], additionalOptionsBags: [OptionsBag] = []
     ) {
 
         super.init(name: "JavaScriptEnvironment")
@@ -620,6 +620,10 @@ public class JavaScriptEnvironment: ComponentBase {
         registerOptionsBag(.jsIntlLocaleMatcherSettings)
         registerOptionsBag(.jsIteratorZipSettings)
 
+        for optionsBag in additionalOptionsBags {
+            registerOptionsBag(optionsBag)
+        }
+
         registerTemporalFieldsObject(
             .jsTemporalPlainTimeLikeObject, forWith: false, dateFields: false, timeFields: true,
             zonedFields: false)
@@ -983,6 +987,7 @@ public class JavaScriptEnvironment: ComponentBase {
     public func registerOptionsBag(_ bag: OptionsBag) {
         registerObjectGroup(bag.group)
 
+        assert(!bag.properties.isEmpty, "OptionsBag with should have at least one property")
         for property in bag.properties.values {
             if property.isEnumeration {
                 assert(
@@ -1189,27 +1194,31 @@ public struct ObjectGroup {
 //
 // It is useful to be able to represent simple options bags so that we can efficiently codegen them
 public struct OptionsBag {
+    public enum SelectionMode {
+        // Select any random subset of options
+        case anySubset
+        // Select exactly one random option
+        case exactlyOne
+    }
+
     // The type of each property, not including `| .undefined`.
     // We may extend this once we start supporting more complex bags
     public var properties: [String: ILType]
     // An ObjectGroup representing this bag
     public var group: ObjectGroup
+    // Determines how the OptionsBag selects from among the possible options
+    public var selectionMode: SelectionMode
 
-    public init(name: String, properties: [String: ILType]) {
+    public init(
+        name: String, properties: [String: ILType], selectionMode: SelectionMode = .anySubset
+    ) {
         self.properties = properties
         let properties = properties.mapValues {
-            // This list can be expanded over time as long as createOptionsBag() supports this
-            assert(
-                $0.isEnumeration || $0.Is(.number | .integer | .boolean | .iterable())
-                    // Has a producing generator registered
-                    || $0.Is(.jsTemporalPlainTime)
-                    // Has explicit support in createOptionsBag
-                    || $0.Is(OptionsBag.jsTemporalRelativeTo),
-                "Found unsupported option type \($0) in options bag \(name)")
             return $0 | .undefined
         }
         self.group = ObjectGroup(
             name: name, instanceType: nil, properties: properties, overloads: [:])
+        self.selectionMode = selectionMode
     }
 }
 

Sources/Fuzzilli/Profiles/DuktapeProfile.swift

@@ -65,5 +65,7 @@ let duktapeProfile = Profile(
 
     additionalEnumerations: [],
 
+    additionalOptionsBags: [],
+
     optionalPostProcessor: nil
 )

Sources/Fuzzilli/Profiles/JSCProfile.swift

@@ -134,5 +134,7 @@ let jscProfile = Profile(
 
     additionalEnumerations: [],
 
+    additionalOptionsBags: [],
+
     optionalPostProcessor: nil
 )

Sources/Fuzzilli/Profiles/JerryscriptProfile.swift

@@ -61,5 +61,7 @@ let jerryscriptProfile = Profile(
 
     additionalEnumerations: [],
 
+    additionalOptionsBags: [],
+
     optionalPostProcessor: nil
 )

Sources/Fuzzilli/Profiles/NjsProfile.swift

@@ -57,5 +57,7 @@ let njsProfile = Profile(
 
     additionalEnumerations: [],
 
+    additionalOptionsBags: [],
+
     optionalPostProcessor: nil
 )

Sources/Fuzzilli/Profiles/Profile.swift

@@ -36,6 +36,7 @@ public struct Profile {
     public let additionalBuiltins: [String: ILType]
     public let additionalObjectGroups: [ObjectGroup]
     public let additionalEnumerations: [ILType]
+    public let additionalOptionsBags: [OptionsBag]
 
     // An optional post-processor that is executed for every sample generated for fuzzing and can modify it.
     public let optionalPostProcessor: FuzzingPostProcessor?

Sources/Fuzzilli/Profiles/QjsProfile.swift

@@ -59,5 +59,7 @@ let qjsProfile = Profile(
 
     additionalEnumerations: [],
 
+    additionalOptionsBags: [],
+
     optionalPostProcessor: nil
 )

Sources/Fuzzilli/Profiles/QtjsProfile.swift

@@ -70,5 +70,7 @@ let qtjsProfile = Profile(
 
     additionalEnumerations: [],
 
+    additionalOptionsBags: [],
+
     optionalPostProcessor: nil
 )

Sources/Fuzzilli/Profiles/Serenity.swift

@@ -53,5 +53,7 @@ let serenityProfile = Profile(
 
     additionalEnumerations: [],
 
+    additionalOptionsBags: [],
+
     optionalPostProcessor: nil
 )