Allow adding additional ObjectGroups to environment using Profile

[0xedward]

As far as I'm aware, currently the only way to add additional ObjectGroups to the JS environment requires maintaining a separate fork of Fuzzilli. I thought allowing users of Fuzzilli to supply additional ObjectGroups in their Profiles would remove the need to maintain a separate fork to have a different JS environment from the main branch of Fuzzilli.

An example of a fork that could've benefited from this change is fuzzilli4wasm

Example use case

For Hermes, we want to fuzz the TextEncoder web API (facebook/hermes@3863a36, facebook/hermes@7f9d9d5, facebook/hermes@14790c9):

// HermesProfile.swift
import Fuzzilli

let TextEncoderConstructor = ILType.object(ofGroup: "TextEncoder", withProperties: ["encoding"], withMethods: ["encodeInto", "encode"])

let hermesProfile = Profile(

    // ...

    additionalBuiltins: [
        "TextEncoder"           : TextEncoderConstructor,
    ],

    additionalObjectGroups: [
        ObjectGroup(
            name: "TextEncoder",
            instanceType: TextEncoderConstructor,
            properties: [
                "encoding"      : .jsString,
            ],
            methods: [
                "encodeInto"    : [.string] => .jsTypedArray("Uint8Array"),
                "encode"        : [.string, .iterable] => .object(), // Just an example, but .iterable should be a Uint8Array instead
            ]),
    ],

    // ...
)

Test plan

1. Updated Fuzzilli.JavaScriptEnvironment.groups and Fuzzilli.JavaScriptEnvironment.builtinTypes access control modifiers from private to public
2. Added print statements to print environment.groups and environment.builtinTypes in FuzzilliCli/main.swift
3. Ran Fuzzilli - swift run FuzzilliCli --profile=hermes ../fuzzilli_build/bin/fuzzilli --storagePath=./corpus --logLevel=verbose
4. Checked that TextEncoder is in the output for environment.groups and environment.builtinTypes

[0xedward]

Suggested change

	logger.verbose("Loaded additional builtins from profile: \(profile.additionalBuiltins.map { $0.key })")
	}
	if !profile.additionalObjectGroups.isEmpty {
	logger.verbose("Loaded additional ObjectGroups from profile: \(profile.additionalObjectGroups.map { $0.name })")
	logger.info("Loaded additional builtins from profile: \(profile.additionalBuiltins.map { $0.key })")
	}
	if !profile.additionalObjectGroups.isEmpty {
	logger.info("Loaded additional ObjectGroups from profile: \(profile.additionalObjectGroups.map { $0.name })")

What are your thoughts on using logger.info instead logger.verbose here?

[carl-smith]

I don't think this logging is necessary as we will also print all registered builtins in the initialize function in the JavaScriptEnvironment. So if you want to keep this for visibility then we should use .verbose, otherwise I think we could also drop this, your choice :)

[0xedward]

Ah, I noticed that initialize in JavaScriptEnvironment prints all the registered builtins and objectGroups. Since we fuzz using quite a few Fuzzilli profiles, I think we'd find it helpful to have which of the objectGroups and builtins were loaded from the profile without having to search through the full list of objectGroups and builtins in our logs

[carl-smith]

Nice!

[carl-smith]

I don't think this logging is necessary as we will also print all registered builtins in the initialize function in the JavaScriptEnvironment. So if you want to keep this for visibility then we should use .verbose, otherwise I think we could also drop this, your choice :)

[0xedward]

Thanks for the review, Carl! :)