extend ufuzz generator (#1783)

- property access
- property assignment
- allow bare expression within try-block
- normalise `Error` in `console.log()`
- generate more unary expressions
- add parenthesis to enforce precedence
- adjust variable reuse/creation
- add parameters to function declaration & expression
- add return expression
- add trivial arguments to function call

test/sandbox.js

@@ -29,7 +29,7 @@ exports.run_code = function(code) {
             console: {
                 log: function() {
                     return console.log.apply(console, [].map.call(arguments, function(arg) {
-                        return typeof arg == "function" ? arg.toString() : arg;
+                        return typeof arg == "function" || arg && /Error$/.test(arg.name) ? arg.toString() : arg;
                     }));
                 }
             }