[maglev] Turn on fuzzing for --maglev

Turn on fuzzing for Maglev to get additional test coverage.

Bug: v8:7700
Change-Id: I5b72d851639e31dff1bd91361cd81ad448c2d69e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629334
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80416}

tools/clusterfuzz/foozzie/v8_fuzz_flags.json

@@ -31,5 +31,6 @@
   [0.1, "--no-wasm-generic-wrapper"],
   [0.1, "--turbo-force-mid-tier-regalloc"],
   [0.0001, "--simulate-errors"],
+  [0.1, "--maglev"],
   [0.25, "--compact-maps"]
 ]

tools/clusterfuzz/trials/clusterfuzz_trials_config.json

@@ -6,6 +6,7 @@
     {"app_args": "--future", "app_name": "d8", "probability": 0.25},
     {"app_args": "--interrupt-budget=1000", "app_name": "d8", "probability": 0.25},
     {"app_args": "--jitless", "app_name": "d8", "probability": 0.1},
+    {"app_args": "--maglev", "app_name": "d8", "probability": 0.1},
     {"app_args": "--random-gc-interval=2000", "app_name": "d8", "probability": 0.05},
     {"app_args": "--noanalyze-environment-liveness", "app_name": "d8", "probability": 0.1},
     {"app_args": "--no-enable-avx", "app_name": "d8", "probability": 0.1},

tools/testrunner/testproc/fuzzer.py

@@ -20,6 +20,7 @@ EXTRA_FLAGS = [
     (0.2, '--future'),
     (0.1, '--interrupt-budget=100'),
     (0.1, '--liftoff'),
+    (0.1, '--maglev'),
     (0.2, '--no-analyze-environment-liveness'),
     # TODO(machenbach): Enable when it doesn't collide with crashing on missing
     # simd features.