Support feature/nullish coalescing

googleprojectzero · Nov 18, 2024 · 6f2e6dc · 6f2e6dc
1 parent 0e20cd5
commit 6f2e6dc
Show file tree

Hide file tree

Showing 4 changed files with 9 additions and 1 deletion.
diff --git a/Sources/Fuzzilli/FuzzIL/JSTyper.swift b/Sources/Fuzzilli/FuzzIL/JSTyper.swift
@@ -427,7 +427,8 @@ public struct JSTyper: Analyzer {
                  .UnRShift:
                 return maybeBigIntOr(.integer)
             case .LogicAnd,
-                 .LogicOr:
+                 .LogicOr,
+                 .NullCoalesce:
                 return state.type(of: inputs[0]) | state.type(of: inputs[1])
             }
         }

diff --git a/Sources/Fuzzilli/FuzzIL/JsOperations.swift b/Sources/Fuzzilli/FuzzIL/JsOperations.swift
@@ -1403,6 +1403,8 @@ public enum BinaryOperator: String, CaseIterable {
     case RShift   = ">>"
     case Exp      = "**"
     case UnRShift = ">>>"
+    // Nullish coalescing operator (??)
+    case NullCoalesce = "??"
 
     var token: String {
         return self.rawValue

diff --git a/Sources/Fuzzilli/Lifting/JavaScriptRuntimeAssistedMutatorLifting.swift b/Sources/Fuzzilli/Lifting/JavaScriptRuntimeAssistedMutatorLifting.swift
@@ -389,6 +389,7 @@ struct JavaScriptRuntimeAssistedMutatorLifting {
         const OP_LOGICAL_AND = 'LOGICAL_AND';
         const OP_LOGICAL_OR = 'LOGICAL_OR';
         const OP_LOGICAL_NOT = 'LOGICAL_NOT';
+        const OP_LOGICAL_NullCoalesce = 'LOGICAL_NullCoalesce';
 
         const OP_BITWISE_AND = 'BITWISE_AND';
         const OP_BITWISE_OR = 'BITWISE_OR';
@@ -511,6 +512,7 @@ struct JavaScriptRuntimeAssistedMutatorLifting {
           [OP_LOGICAL_AND]: (inputs) => inputs[0] && inputs[1],
           [OP_LOGICAL_OR]: (inputs) => inputs[0] || inputs[1],
           [OP_LOGICAL_NOT]: (inputs) => !inputs[0],
+          [OP_LOGICAL_NullCoalesce]: (inputs) => inputs[0] ?? inputs[1],
           [OP_BITWISE_AND]: (inputs) => inputs[0] & inputs[1],
           [OP_BITWISE_OR]: (inputs) => inputs[0] | inputs[1],
           [OP_BITWISE_XOR]: (inputs) => inputs[0] ^ inputs[1],

diff --git a/Sources/Fuzzilli/Mutators/RuntimeAssistedMutator.swift b/Sources/Fuzzilli/Mutators/RuntimeAssistedMutator.swift
@@ -186,6 +186,7 @@ public class RuntimeAssistedMutator: Mutator {
         case LogicalAnd = "LOGICAL_AND"
         case LogicalOr = "LOGICAL_OR"
         case LogicalNot = "LOGICAL_NOT"
+        case NullCoalesce = "NullCoalesce"
         case BitwiseAnd = "BITWISE_AND"
         case BitwiseOr = "BITWISE_OR"
         case BitwiseXor = "BITWISE_XOR"
@@ -385,6 +386,8 @@ extension RuntimeAssistedMutator.Action {
             try translateBinaryOperation(.BitOr)
         case .BitwiseXor:
             try translateBinaryOperation(.Xor)
+        case .NullCoalesce:
+            try translateBinaryOperation(.NullCoalesce)    
         case .LeftShift:
             try translateBinaryOperation(.LShift)
         case .SignedRightShift: