[js] OperationMutator: Fix crash caused by wrong destruct inout count

Fixed: 542466166
Change-Id: I51c3c73075834d4db211ad5304ba3a04e6af36dc
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9631416
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Michael Achenbach <machenbach@google.com>

Author: Liedtke

Sources/Fuzzilli/Mutators/OperationMutator.swift

@@ -635,7 +635,11 @@ public class OperationMutator: BaseInstructionMutator {
             if let newPattern = mutateDestructuringPattern(
                 op.pattern, b, &inouts, isReassign: false)
             {
-                newOp = Destruct(pattern: newPattern, numInputs: 1, numOutputs: inouts.count - 1)
+                newOp = Destruct(
+                    pattern: newPattern,
+                    numInputs: 1 + newPattern.numExtraInputs,
+                    numOutputs: newPattern.numBindings
+                )
             } else {
                 return instr
             }

Tests/FuzzilliTests/MutatorTests.swift

@@ -859,4 +859,42 @@ struct MutatorTests {
             mutatedProg.checkOrDie(onFailure: "Program must be statically valid")
         }
     }
+
+    @Test func testOperationMutatorDestructPatternCrash() throws {
+        let fuzzer = makeMockFuzzer()
+        try fuzzer.sync {
+            let pattern = DestructuringPattern.array(
+                .init(
+                    elements: [
+                        .init(target: .flatBinding, hasDefaultValue: true)
+                    ],
+                    restTarget: nil
+                )
+            )
+
+            let b = fuzzer.makeBuilder()
+            let source = b.loadInt(1)
+            let defaultValue = b.loadInt(2)
+            b.destruct(source, using: pattern, defaultValues: [defaultValue])
+            let prog = b.finalize()
+
+            let mutator = OperationMutator()
+
+            let newBuilder = fuzzer.makeBuilder()
+            newBuilder.adopting {
+                for instr in prog.code {
+                    if instr.op is Destruct {
+                        mutator.mutate(instr, newBuilder)
+                    } else {
+                        newBuilder.adopt(instr)
+                    }
+                }
+            }
+
+            let mutatedProg = newBuilder.finalize()
+            // The program should be valid and lifting should not crash.
+            try mutatedProg.code.check()
+            _ = FuzzILLifter().lift(mutatedProg)
+        }
+    }
 }