Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature/switch statement js compiler #440

Conversation

TobiasWienand
Copy link
Contributor

@TobiasWienand TobiasWienand commented Aug 7, 2024

Addresses #437

The code makes switch statements compilable from JS to FuzzIL.

The scoping is implemented as described in the comments.

A BreakStatement is processed as a SwitchBreak if it is found in a SwitchCase . Everywhere else, it is still a LoopBreak. (See here for the test to determine if the mapping break -> {Loop Break, Switch Break} functions properly.

Instead of calling compileStatement on the BreakStatement in the SwitchCase, we simply set the fallsThrough argument to true for the EndSwitchCase. This causes the SwitchBreak to be emitted outside of Compiler.swift

Copy link
Collaborator

@saelo saelo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great, thanks!

Sources/Fuzzilli/Compiler/Compiler.swift Outdated Show resolved Hide resolved
Sources/Fuzzilli/Compiler/Compiler.swift Outdated Show resolved Hide resolved
Sources/Fuzzilli/Compiler/Compiler.swift Show resolved Hide resolved
1. Shortens the map statement in JS parser
2. precomputedTests in the Compiler now only contains Variables, not nil
3. A TODO comment that proposes dynamic compilation of switch cases is added
This change ensures that when a break statement is encountered in the Compiler, the appropriate break type (LoopBreak or SwitchBreak) is emitted based on context.

3 out 4 cases are not a problem:
- Case 1: If neither .loop nor .switchBlock is in context, an error is raised.
- Case 2: If .loop is in context but not .switchBlock, emit LoopBreak.
- Case 3: If .switchBlock is in context but not .loop, emit SwitchBreak.
- Case 4 (problem): If both are in context, the innermost context needs to be determined.

For Case 4, the existing contextStack doesn't track which context was opened most recently. A new breakContextStack is introduced to handle this. Minor modifications to the Instruction and Attributes classes were made to manage pushing and popping of break context information.
Sources/Fuzzilli/Compiler/Compiler.swift Outdated Show resolved Hide resolved
Sources/Fuzzilli/FuzzIL/Analyzer.swift Outdated Show resolved Hide resolved
Sources/Fuzzilli/Compiler/Compiler.swift Outdated Show resolved Hide resolved
These changes move the logic for break context identification out of the performance ciritical part of the Fuzzilli project and into the compiler.

The idea is straight-forward: We fix the bug in the context analyzer that caused contexts to contain both .loop and .switchBlock by simply removing the loop context upon opening a switchBlock context and vice versa.
Sources/Fuzzilli/Compiler/Compiler.swift Outdated Show resolved Hide resolved
Sources/Fuzzilli/Compiler/Compiler.swift Show resolved Hide resolved
Sources/Fuzzilli/FuzzIL/Analyzer.swift Outdated Show resolved Hide resolved
@saelo saelo merged commit fe8013b into googleprojectzero:main Aug 22, 2024
2 of 3 checks passed
saelo pushed a commit that referenced this pull request Aug 22, 2024
* Implements JS->FuzzIL translatability for switch statements
* Implements compiler tests for the switch statement
* Improves Compiler and JS Parser
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants