Implement LoadThis and LoadArguments operations (googleprojectzero#262)

Author: amarekano

Sources/Fuzzilli/Core/CodeGenerators.swift

@@ -50,6 +50,15 @@ public let CodeGenerators: [CodeGenerator] = [
         b.loadNull()
     },
 
+    CodeGenerator("ThisGenerator") { b in
+        b.loadThis()
+    },
+
+    CodeGenerator("ArgumentsGenerator", inContext: .function) { b in
+        assert(b.context.contains(.function))
+        b.loadArguments()
+    },
+
     CodeGenerator("ObjectGenerator") { b in
         var initialProperties = [String: Variable]()
         for _ in 0..<Int.random(in: 0...10) {

Sources/Fuzzilli/Core/JavaScriptEnvironment.swift

@@ -169,10 +169,6 @@ public class JavaScriptEnvironment: ComponentBase, Environment {
         registerBuiltin("NaN", ofType: .jsNaN)
         registerBuiltin("Infinity", ofType: .jsInfinity)
 
-        // Register pseudo builtins
-        registerBuiltin("this", ofType: .object())
-        registerBuiltin("arguments", ofType: .object())
-
         for (builtin, type) in additionalBuiltins {
             registerBuiltin(builtin, ofType: type)
         }

Sources/Fuzzilli/Core/ProgramBuilder.swift

@@ -1009,6 +1009,16 @@ public class ProgramBuilder {
         return perform(LoadNull()).output
     }
 
+    @discardableResult
+    public func loadThis() -> Variable {
+        return perform(LoadThis()).output
+    }
+
+    @discardableResult
+    public func loadArguments() -> Variable {
+        return perform(LoadArguments()).output
+    }
+
     @discardableResult
     public func loadRegExp(_ value: String, _ flags: RegExpFlags) -> Variable {
         return perform(LoadRegExp(value: value, flags: flags)).output

Sources/Fuzzilli/FuzzIL/AbstractInterpreter.swift

@@ -319,6 +319,12 @@ public struct AbstractInterpreter {
         case is LoadNull:
             set(instr.output, .undefined)
 
+        case is LoadThis:
+            set(instr.output, .object())
+
+        case is LoadArguments:
+            set(instr.output, .iterable)
+
         case is LoadRegExp:
             set(instr.output, environment.regExpType)
 

Sources/Fuzzilli/FuzzIL/Instruction.swift

@@ -280,6 +280,10 @@ extension Instruction: ProtobufConvertible {
                 $0.loadUndefined = Fuzzilli_Protobuf_LoadUndefined()
             case is LoadNull:
                 $0.loadNull = Fuzzilli_Protobuf_LoadNull()
+            case is LoadThis:
+                $0.loadThis = Fuzzilli_Protobuf_LoadThis()
+            case is LoadArguments:
+                $0.loadArguments = Fuzzilli_Protobuf_LoadArguments()
             case let op as LoadRegExp:
                 $0.loadRegExp = Fuzzilli_Protobuf_LoadRegExp.with { $0.value = op.value; $0.flags = op.flags.rawValue }
             case let op as CreateObject:
@@ -514,6 +518,10 @@ extension Instruction: ProtobufConvertible {
             op = LoadUndefined()
         case .loadNull(_):
             op = LoadNull()
+        case .loadThis(_):
+            op = LoadThis()
+        case .loadArguments(_):
+            op = LoadArguments()
         case .loadRegExp(let p):
             op = LoadRegExp(value: p.value, flags: RegExpFlags(rawValue: p.flags))
         case .createObject(let p):

Sources/Fuzzilli/FuzzIL/Operations.swift

@@ -137,6 +137,18 @@ class LoadNull: Operation {
     }
 }
 
+class LoadThis: Operation {
+    init() {
+        super.init(numInputs: 0, numOutputs: 1, attributes: [.isPure])
+    }
+}
+
+class LoadArguments: Operation {
+    init() {
+        super.init(numInputs: 0, numOutputs: 1, attributes: [.isPure])
+    }
+}
+
 public struct RegExpFlags: OptionSet, Hashable {
     public let rawValue: UInt32
 

Sources/Fuzzilli/FuzzIL/Semantics.swift

@@ -111,6 +111,10 @@ extension Instruction {
             canFold = true
         case (is LoadNull, is LoadNull):
             canFold = true
+        case (is LoadThis, is LoadThis):
+            canFold = false
+        case (is LoadArguments, is LoadArguments):
+            canFold = false
         case (let op1 as LoadRegExp, let op2 as LoadRegExp):
             canFold = op1.value  == op2.value && op1.flags == op2.flags
         case (let op1 as LoadBuiltin, let op2 as LoadBuiltin):

Sources/Fuzzilli/Lifting/FuzzILLifter.swift

@@ -49,6 +49,12 @@ public class FuzzILLifter: Lifter {
         case is LoadNull:
             w.emit("\(instr.output) <- LoadNull")
 
+        case is LoadThis:
+            w.emit("\(instr.output) <- LoadThis")
+
+        case is LoadArguments:
+            w.emit("\(instr.output) <- LoadArguments")
+
         case let op as CreateObject:
             var properties = [String]()
             for (index, propertyName) in op.propertyNames.enumerated() {

Sources/Fuzzilli/Lifting/JavaScriptLifter.swift

@@ -182,6 +182,12 @@ public class JavaScriptLifter: Lifter {
             case is LoadNull:
                 output = Literal.new("null")
 
+            case is LoadThis:
+                output = Literal.new("this")
+
+            case is LoadArguments:
+                output = Literal.new("arguments")
+
             case let op as CreateObject:
                 var properties = [String]()
                 for (index, propertyName) in op.propertyNames.enumerated() {

Sources/Fuzzilli/Protobuf/operations.pb.swift

@@ -330,6 +330,26 @@ public struct Fuzzilli_Protobuf_LoadNull {
   public init() {}
 }
 
+public struct Fuzzilli_Protobuf_LoadThis {
+  // SwiftProtobuf.Message conformance is added in an extension below. See the
+  // `Message` and `Message+*Additions` files in the SwiftProtobuf library for
+  // methods supported on all messages.
+
+  public var unknownFields = SwiftProtobuf.UnknownStorage()
+
+  public init() {}
+}
+
+public struct Fuzzilli_Protobuf_LoadArguments {
+  // SwiftProtobuf.Message conformance is added in an extension below. See the
+  // `Message` and `Message+*Additions` files in the SwiftProtobuf library for
+  // methods supported on all messages.
+
+  public var unknownFields = SwiftProtobuf.UnknownStorage()
+
+  public init() {}
+}
+
 public struct Fuzzilli_Protobuf_LoadRegExp {
   // SwiftProtobuf.Message conformance is added in an extension below. See the
   // `Message` and `Message+*Additions` files in the SwiftProtobuf library for
@@ -1593,6 +1613,44 @@ extension Fuzzilli_Protobuf_LoadNull: SwiftProtobuf.Message, SwiftProtobuf._Mess
   }
 }
 
+extension Fuzzilli_Protobuf_LoadThis: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
+  public static let protoMessageName: String = _protobuf_package + ".LoadThis"
+  public static let _protobuf_nameMap = SwiftProtobuf._NameMap()
+
+  public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
+    while let _ = try decoder.nextFieldNumber() {
+    }
+  }
+
+  public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
+    try unknownFields.traverse(visitor: &visitor)
+  }
+
+  public static func ==(lhs: Fuzzilli_Protobuf_LoadThis, rhs: Fuzzilli_Protobuf_LoadThis) -> Bool {
+    if lhs.unknownFields != rhs.unknownFields {return false}
+    return true
+  }
+}
+
+extension Fuzzilli_Protobuf_LoadArguments: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
+  public static let protoMessageName: String = _protobuf_package + ".LoadArguments"
+  public static let _protobuf_nameMap = SwiftProtobuf._NameMap()
+
+  public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
+    while let _ = try decoder.nextFieldNumber() {
+    }
+  }
+
+  public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
+    try unknownFields.traverse(visitor: &visitor)
+  }
+
+  public static func ==(lhs: Fuzzilli_Protobuf_LoadArguments, rhs: Fuzzilli_Protobuf_LoadArguments) -> Bool {
+    if lhs.unknownFields != rhs.unknownFields {return false}
+    return true
+  }
+}
+
 extension Fuzzilli_Protobuf_LoadRegExp: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
   public static let protoMessageName: String = _protobuf_package + ".LoadRegExp"
   public static let _protobuf_nameMap: SwiftProtobuf._NameMap = [