[v8] Add generator for %AllocateHeapNumberWithValue()

V8-side change: https://crrev.com/c/7623762

Bug: 487620644
Change-Id: Iee848582cf8ed19085daea8c7715bf8c3f54f3d9
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9064480
Reviewed-by: Michael Achenbach <machenbach@google.com>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>

Author: Liedtke

Sources/FuzzilliCli/Profiles/V8CommonProfile.swift

@@ -177,6 +177,13 @@ public let UndefinedNanGenerator = CodeGenerator("UndefinedNanGenerator") { b in
     b.eval("%GetUndefinedNaN()", hasOutput: true);
 }
 
+public let HeapNumberGenerator = CodeGenerator("HeapNumberGenerator", inputs: .preferred(.integer))
+{ b, value in
+    // This generator prefers an integer input as these have a high chance of being representable as
+    // a Smi, meaning that we often end up with a HeapNumber that didn't have to be materialized.
+    b.eval("%AllocateHeapNumberWithValue(%@)", with: [value], hasOutput: true);
+}
+
 public let StringShapeGenerator = CodeGenerator("StringShapeGenerator") { b in
     withEqualProbability(
         {

Sources/FuzzilliCli/Profiles/V8Profile.swift

@@ -75,6 +75,7 @@ let v8Profile = Profile(
         (HoleNanGenerator,                         5),
         (UndefinedNanGenerator,                    5),
         (StringShapeGenerator,                     5),
+        (HeapNumberGenerator,                      5),
     ],
 
     additionalProgramTemplates: WeightedList<ProgramTemplate>([