Implements compilation of new parameter types

Sources/Fuzzilli/Compiler/Compiler.swift

@@ -468,7 +468,10 @@ public class JavaScriptCompiler {
                 try enterNewScope {
                     let beginCatch = emit(BeginCatch())
                     if tryStatement.catch.hasParameter {
-                        map(tryStatement.catch.parameter.name, to: beginCatch.innerOutput)
+                        guard case let .identifierParameter(identifier) = tryStatement.catch.parameter.parameter else {
+                            throw CompilerError.unsupportedFeatureError("Only identifier parameters are supported in catch blocks")
+                        }
+                        map(identifier.name, to: beginCatch.innerOutput)
                     }
                     for statement in tryStatement.catch.body {
                         try compileStatement(statement)
@@ -1071,14 +1074,71 @@ public class JavaScriptCompiler {
     }
 
     private func mapParameters(_ parameters: [Compiler_Protobuf_Parameter], to variables: ArraySlice<Variable>) {
-        assert(parameters.count == variables.count)
-        for (param, v) in zip(parameters, variables) {
-            map(param.name, to: v)
+        // Maps parameters of a function to variables that are used in that function's scope.
+        // func extractIdentifiers and var flatParameters help to process object and array patterns.
+        var flatParameters: [String] = []
+        func extractIdentifiers(from param: Compiler_Protobuf_Parameter) {
+            switch param.parameter {
+            case .identifierParameter(let identifier):
+                flatParameters.append(identifier.name)
+            case .objectParameter(let object):
+                for property in object.parameters {
+                    extractIdentifiers(from: property.parameterValue)
+                }
+            case .arrayParameter(let array):
+                for element in array.elements {
+                    extractIdentifiers(from: element)
+                }
+            case .none:
+                fatalError("Unexpected parameter type: .none in mapParameters")
+            }
+        }
+        for param in parameters {
+            extractIdentifiers(from: param)
+        }
+        assert(flatParameters.count == variables.count, "The number of variables (\(variables.count)) does not match the number of parameters (\(flatParameters.count)).")
+        for (name, v) in zip(flatParameters, variables) {
+            map(name, to: v)
         }
     }
 
     private func convertParameters(_ parameters: [Compiler_Protobuf_Parameter]) -> Parameters {
-        return Parameters(count: parameters.count)
+        // Converts a protobuf signature to a FuzzIL signature.
+        var totalParameterCount = 0
+        var patterns = [ParameterPattern]()
+        func processParameter(_ param: Compiler_Protobuf_Parameter) -> ParameterPattern {
+            switch param.parameter {
+            case .identifierParameter(_):
+                totalParameterCount += 1
+                return .identifier
+            case .objectParameter(let object):
+                var properties = [ObjectPatternProperty]()
+                for property in object.parameters {
+                    let key = property.parameterKey
+                    let valuePattern = processParameter(property.parameterValue)
+                    properties.append(ObjectPatternProperty(key: key, value: valuePattern))
+                }
+                return .object(properties: properties)
+            case .arrayParameter(let array):
+                var elements = [ParameterPattern]()
+                for element in array.elements {
+                    let elementPattern = processParameter(element)
+                    elements.append(elementPattern)
+                }
+                return .array(elements: elements)
+            case .none:
+                fatalError("Unexpected parameter type: .none in convertParameters")
+            }
+        }
+        for param in parameters {
+            let pattern = processParameter(param)
+            patterns.append(pattern)
+        }
+        var params = Parameters(
+            count: totalParameterCount
+        )
+        params.patterns = patterns
+        return params
     }
 
     /// Convenience accessor for the currently active scope.

Sources/Fuzzilli/Compiler/Parser/parser.js

@@ -73,8 +73,47 @@ function parse(script, proto) {
     }
 
     function visitParameter(param) {
-        assert(param.type == 'Identifier');
-        return make('Parameter', { name: param.name });
+        assert(['Identifier', 'ObjectPattern', 'ArrayPattern'].includes(param.type));
+        switch (param.type) {
+            case 'Identifier': {
+                return make('IdentifierParameter', { identifierParameter: { name: param.name } });
+            }
+            case 'ObjectPattern': {
+                const parameters = param.properties.map(property => {
+                    assert(property.type === 'ObjectProperty');
+                    assert(property.computed === false);
+                    assert(property.method === false);
+                    let parameterKey;
+                    if (property.key.type === 'Identifier') {
+                        parameterKey = property.key.name;
+                    } else if (property.key.type === 'Literal') {
+                        // Internally, literal keys are stored as strings. So we can convert them to strings here.
+                        parameterKey = property.key.value.toString();
+                    } else {
+                        throw new Error('Unsupported property key type: ' + property.key.type);
+                    }
+                    const parameterValue = visitParameter(property.value);
+                    return make('ObjectParameterProperty', {
+                        parameterKey: parameterKey,
+                        parameterValue: parameterValue
+                    });
+                });
+                return make('ObjectParameter', { objectParameter: { parameters } });
+            }
+            case 'ArrayPattern': {
+                const elements = param.elements.map(element => {
+                    if (element === null) {
+                        throw new Error('Holes in array parameters are not supported');
+                    } else {
+                        return visitParameter(element);
+                    }
+                });
+                return make('ArrayParameter', { arrayParameter: { elements } });
+            }
+            default: {
+                throw new Error('Unsupported parameter type: ' + param.type);
+            }
+        }
     }
 
     function visitVariableDeclaration(node) {

Sources/Fuzzilli/FuzzIL/JSTyper.swift

@@ -170,7 +170,37 @@ public struct JSTyper: Analyzer {
     /// Attempts to infer the parameter types of the given subroutine definition.
     /// If parameter types have been added for this function, they are returned, otherwise generic parameter types (i.e. .anything parameters) for the parameters specified in the operation are generated.
     private func inferSubroutineParameterList(of op: BeginAnySubroutine, at index: Int) -> ParameterList {
-        return signatures[index] ?? ParameterList(numParameters: op.parameters.count, hasRestParam: op.parameters.hasRestParameter)
+        if let signature = signatures[index] {
+            return signature
+        } else {
+            var parameterList = ParameterList()
+            let patterns = op.parameters.patterns
+            let hasRestParam = op.parameters.hasRestParameter
+
+            for (i, pattern) in patterns.enumerated() {
+                let ilType = inferParameterType(from: pattern)
+                let parameter: Parameter
+                if hasRestParam && i == patterns.count - 1 {
+                    parameter = .rest(ilType)
+                } else {
+                    parameter = .plain(ilType)
+                }
+                parameterList.append(parameter)
+            }
+            return parameterList
+        }
+    }
+
+    private func inferParameterType(from pattern: ParameterPattern) -> ILType {
+        switch pattern {
+        case .identifier:
+            return .anything
+        case .array:
+            return .iterable
+        case .object:
+            // TODO be more precise here: Describe the object parameters structure
+            return .object()
+        }
     }
 
     // Set type to current state and save type change event

Sources/Fuzzilli/FuzzIL/JsOperations.swift

@@ -1047,21 +1047,38 @@ final class TestIn: JsOperation {
 
 }
 
+enum ParameterPattern {
+    case identifier
+    case object(properties: [ObjectPatternProperty])
+    case array(elements: [ParameterPattern])
+}
+
+struct ObjectPatternProperty {
+    let key: String
+    let value: ParameterPattern
+}
+
 // The parameters of a FuzzIL subroutine.
 public struct Parameters {
-    /// The total number of parameters.
-    private let numParameters: UInt32
+    /// The total number of variables after destructuring object- and array patterns.
+    /// Example: f({a, b}, [c, d]) has 4 variables, not 2.
+    private let numVariables: UInt32
     /// Whether the last parameter is a rest parameter.
+    /// TODO make the rest parameter an actual parameter type.
     let hasRestParameter: Bool
 
-    /// The total number of parameters. This is equivalent to the number of inner outputs produced from the parameters.
     var count: Int {
-        return Int(numParameters)
+        return Int(numVariables)
     }
 
-    init(count: Int, hasRestParameter: Bool = false) {
-        self.numParameters = UInt32(count)
+    var patterns: [ParameterPattern]
+    init(
+        count: Int,
+        hasRestParameter: Bool = false
+    ) {
+        self.numVariables = UInt32(count)
         self.hasRestParameter = hasRestParameter
+        self.patterns = []
     }
 }
 

Sources/Fuzzilli/Lifting/JavaScriptLifter.swift

@@ -1355,15 +1355,33 @@ public class JavaScriptLifter: Lifter {
 
     private func liftParameters(_ parameters: Parameters, as variables: [String]) -> String {
         assert(parameters.count == variables.count)
-        var paramList = [String]()
-        for v in variables {
-            if parameters.hasRestParameter && v == variables.last {
-                paramList.append("..." + v)
-            } else {
-                paramList.append(v)
+        var variableIndex = 0
+        func liftPattern(_ pattern: ParameterPattern) -> String {
+            switch pattern {
+            case .identifier:
+                let variableName = variables[variableIndex]
+                variableIndex += 1
+                return variableName
+
+            case .object(let properties):
+                let liftedProperties = properties.map { property -> String in
+                    let key = property.key
+                    let value = liftPattern(property.value)
+                    return "\(key): \(value)"
+                }
+                return "{ " + liftedProperties.joined(separator: ", ") + " }"
+
+            case .array(let elements):
+                let liftedElements = elements.map { element -> String in
+                    return liftPattern(element)
+                }
+                return "[ " + liftedElements.joined(separator: ", ") + " ]"
             }
         }
-        return paramList.joined(separator: ", ")
+        let liftedParams = parameters.patterns.map { pattern in
+            return liftPattern(pattern)
+        }
+        return liftedParams.joined(separator: ", ")
     }
 
     private func liftFunctionDefinitionBegin(_ instr: Instruction, keyword FUNCTION: String, using w: inout JavaScriptWriter) {