[wasm] Enable --wasm-staging in libfuzzer fuzzers

As described in https://docs.google.com/document/d/1hB8mpWmzmtaxZ8PuJEkAWLwFqXTjrw7mJ3Ge9W1dB4E,
we want to enable --wasm-staging for libfuzzer fuzzers to increase test
coverage of new feature implementations. As discussed in https://docs.google.com/a/chromium.org/document/d/1hB8mpWmzmtaxZ8PuJEkAWLwFqXTjrw7mJ3Ge9W1dB4E/edit?disco=AAAADPrjhdA,
this has to be done in our implementations manually.


R=thibaudm@chromium.org

Bug: v8:9601
Change-Id: Iab35af75bb71b6fca697ab7e4ac37b04e1d6da35
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1768581Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63392}

test/fuzzer/wasm-fuzzer-common.cc

@@ -140,6 +140,8 @@ void GenerateTestCase(Isolate* isolate, ModuleWireBytes wire_bytes,
         "can be\n"
         "// found in the LICENSE file.\n"
         "\n"
+        "// Flags: --wasm-staging\n"
+        "\n"
         "load('test/mjsunit/wasm/wasm-module-builder.js');\n"
         "\n"
         "(function() {\n"
@@ -249,6 +251,11 @@ void GenerateTestCase(Isolate* isolate, ModuleWireBytes wire_bytes,
 
 void WasmExecutionFuzzer::FuzzWasmModule(Vector<const uint8_t> data,
                                          bool require_valid) {
+  // We explicitly enable staged WebAssembly features here to increase fuzzer
+  // coverage. For libfuzzer fuzzers it is not possible that the fuzzer enables
+  // the flag by itself.
+  FlagScope<bool> enable_staged_features(&FLAG_wasm_staging, true);
+
   // Strictly enforce the input size limit. Note that setting "max_len" on the
   // fuzzer target is not enough, since different fuzzers are used and not all
   // respect that limit.

test/fuzzer/wasm.cc

@@ -20,6 +20,13 @@
 namespace i = v8::internal;
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  // We explicitly enable staged WebAssembly features here to increase fuzzer
+  // coverage. For libfuzzer fuzzers it is not possible that the fuzzer enables
+  // the flag by itself.
+  i::FlagScope<bool> enable_staged_features(&i::FLAG_wasm_staging, true);
+
+  // We reduce the maximum memory size and table size of WebAssembly instances
+  // to avoid OOMs in the fuzzer.
   i::FlagScope<uint32_t> max_mem_flag_scope(&i::FLAG_wasm_max_mem_pages, 32);
   i::FlagScope<uint32_t> max_table_size_scope(&i::FLAG_wasm_max_table_size,
                                               100);