Added support for finally blocks (googleprojectzero#196)

amarekano · web-flow · commit 2e8f6484312a · 2021-06-02T11:22:05.000+02:00
diff --git a/Sources/Fuzzilli/Core/CodeGenerators.swift b/Sources/Fuzzilli/Core/CodeGenerators.swift
@@ -444,9 +444,25 @@ public let CodeGenerators: [CodeGenerator] = [
         b.beginTry() {
             b.generateRecursive()
         }
-        b.beginCatch() { _ in
-            b.generateRecursive()
-        }
+        withEqualProbability({
+            // try-catch-finally
+            b.beginCatch() { _ in
+                b.generateRecursive()
+            }
+            b.beginFinally() {
+                b.generateRecursive()
+            }
+        }, {
+            // try-catch
+            b.beginCatch() { _ in
+                b.generateRecursive()
+            }
+        }, {
+            // try-finally
+            b.beginFinally() {
+                b.generateRecursive()
+            }
+        })
         b.endTryCatch()
     },
 
diff --git a/Sources/Fuzzilli/Core/ProgramBuilder.swift b/Sources/Fuzzilli/Core/ProgramBuilder.swift
@@ -1261,6 +1261,11 @@ public class ProgramBuilder {
         body(exception)
     }
 
+    public func beginFinally(_ body: () -> Void) {
+        perform(BeginFinally())
+        body()
+    }
+
     public func endTryCatch() {
         perform(EndTryCatch())
     }
diff --git a/Sources/Fuzzilli/FuzzIL/AbstractInterpreter.swift b/Sources/Fuzzilli/FuzzIL/AbstractInterpreter.swift
@@ -70,6 +70,7 @@ public struct AbstractInterpreter {
             state.mergeStates(typeChanges: &typeChanges)
         case is BeginTry,
              is BeginCatch,
+             is BeginFinally,
              is EndTryCatch:
             break
         case is BeginWith,
diff --git a/Sources/Fuzzilli/FuzzIL/Instruction.swift b/Sources/Fuzzilli/FuzzIL/Instruction.swift
@@ -450,6 +450,8 @@ extension Instruction: ProtobufConvertible {
                 $0.beginTry = Fuzzilli_Protobuf_BeginTry()
             case is BeginCatch:
                 $0.beginCatch = Fuzzilli_Protobuf_BeginCatch()
+            case is BeginFinally:
+                $0.beginFinally = Fuzzilli_Protobuf_BeginFinally()
             case is EndTryCatch:
                 $0.endTryCatch = Fuzzilli_Protobuf_EndTryCatch()
             case is ThrowException:
@@ -665,6 +667,8 @@ extension Instruction: ProtobufConvertible {
             op = BeginTry()
         case .beginCatch(_):
             op = BeginCatch()
+        case .beginFinally(_):
+            op = BeginFinally()
         case .endTryCatch(_):
             op = EndTryCatch()
         case .throwException(_):
diff --git a/Sources/Fuzzilli/FuzzIL/Operations.swift b/Sources/Fuzzilli/FuzzIL/Operations.swift
@@ -840,6 +840,12 @@ class BeginCatch: ControlFlowOperation {
     }
 }
 
+class BeginFinally: ControlFlowOperation {
+    init() {
+        super.init(numInputs: 0, attributes: [.isBlockBegin, .isBlockEnd])
+    }
+}
+
 class EndTryCatch: ControlFlowOperation {
     init() {
         super.init(numInputs: 0, attributes: [.isBlockEnd])
diff --git a/Sources/Fuzzilli/FuzzIL/Semantics.swift b/Sources/Fuzzilli/FuzzIL/Semantics.swift
@@ -125,8 +125,10 @@ extension Operation {
         case is BeginForOf:
             return endOp is EndForOf
         case is BeginTry:
-            return endOp is BeginCatch
+            return endOp is BeginCatch || endOp is BeginFinally
         case is BeginCatch:
+            return endOp is BeginFinally || endOp is EndTryCatch
+        case is BeginFinally:
             return endOp is EndTryCatch
         case is BeginCodeString:
             return endOp is EndCodeString
diff --git a/Sources/Fuzzilli/Lifting/FuzzILLifter.swift b/Sources/Fuzzilli/Lifting/FuzzILLifter.swift
@@ -311,6 +311,11 @@ public class FuzzILLifter: Lifter {
             w.emit("BeginCatch -> \(instr.innerOutput)")
             w.increaseIndentionLevel()
 
+        case is BeginFinally:
+            w.decreaseIndentionLevel()
+            w.emit("BeginFinally")
+            w.increaseIndentionLevel()
+
         case is EndTryCatch:
             w.decreaseIndentionLevel()
             w.emit("EndTryCatch")
diff --git a/Sources/Fuzzilli/Lifting/JavaScriptLifter.swift b/Sources/Fuzzilli/Lifting/JavaScriptLifter.swift
@@ -520,6 +520,11 @@ public class JavaScriptLifter: Lifter {
                 w.emit("} catch(\(instr.innerOutput)) {")
                 w.increaseIndentionLevel()
 
+            case is BeginFinally:
+                w.decreaseIndentionLevel()
+                w.emit("} finally {")
+                w.increaseIndentionLevel()
+
             case is EndTryCatch:
                 w.decreaseIndentionLevel()
                 w.emit("}")
diff --git a/Sources/Fuzzilli/Minimization/BlockReducer.swift b/Sources/Fuzzilli/Minimization/BlockReducer.swift
@@ -26,7 +26,7 @@ struct BlockReducer: Reducer {
                 reduceLoop(loop: group.block(0), in: &code, with: verifier)
 
             case is BeginTry:
-                reduceTryCatch(tryCatch: group, in: &code, with: verifier)
+                reduceTryCatchFinally(tryCatch: group, in: &code, with: verifier)
 
             case is BeginIf:
                 // We reduce ifs simply by removing the whole block group.
@@ -115,10 +115,10 @@ struct BlockReducer: Reducer {
         reduceGenericBlockGroup(codestring, in: &code, with: verifier)
     }
 
-    private func reduceTryCatch(tryCatch: BlockGroup, in code: inout Code, with verifier: ReductionVerifier) {
-        // We first try to remove only the try-catch block instructions.
+    private func reduceTryCatchFinally(tryCatch: BlockGroup, in code: inout Code, with verifier: ReductionVerifier) {
+        // We first try to remove only the try-catch-finally block instructions.
         // If that doesn't work, then we try to remove the try block including
-        // its last instruction but keepp the body of the catch block.
+        // its last instruction but keep the body of the catch and/or finally block.
         // If the body isn't required, it will be removed by the
         // other reducers. On the other hand, this successfully
         // reduces code like
@@ -128,35 +128,40 @@ struct BlockReducer: Reducer {
         //         throw 42;
         //     } catch {
         //         do_something_important2();
+        //     } finally {
+        //         do_something_important3();
         //     }
         //
         // to
         //
         //     do_something_important1();
         //     do_something_important2();
+        //     do_something_important3();
         //
 
         var candidates = [Int]()
 
-        candidates.append(tryCatch[0].index)
-        candidates.append(tryCatch[1].index)
-        candidates.append(tryCatch[2].index)
+        for i in 0...tryCatch.numBlocks {
+            candidates.append(tryCatch[i].index)
+        }
 
         if verifier.tryNopping(candidates, in: &code) {
             return
         }
 
+        var removedLastTryBlockInstruction = false
         // Find the last instruction in try block and try removing that as well.
         for i in stride(from: tryCatch[1].index - 1, to: tryCatch[0].index, by: -1) {
             if !(code[i].op is Nop) {
                 if !code[i].isBlock {
                     candidates.append(i)
+                    removedLastTryBlockInstruction = true
                 }
                 break
             }
         }
 
-        if candidates.count == 4 && verifier.tryNopping(candidates, in: &code) {
+        if removedLastTryBlockInstruction && verifier.tryNopping(candidates, in: &code) {
             return
         }
 
@@ -168,15 +173,16 @@ struct BlockReducer: Reducer {
         //             const v17 = Math(v16,v16);
         //         }
         //      } catch {
+        //      } finally {
         //      }
         //
-        if candidates.count == 4 {
+        if removedLastTryBlockInstruction {
             candidates.removeLast()
         }
 
-        // Find last instruction in try block
+        // Remove all instructions in the body of the try block
         for i in stride(from: tryCatch[1].index - 1, to: tryCatch[0].index, by: -1) {
-            if !(tryCatch.code[i].op is Nop) {
+            if !(code[i].op is Nop) {
                 candidates.append(i)
             }
         }
diff --git a/Sources/Fuzzilli/Protobuf/operations.pb.swift b/Sources/Fuzzilli/Protobuf/operations.pb.swift
@@ -1213,6 +1213,16 @@ public struct Fuzzilli_Protobuf_BeginCatch {
   public init() {}
 }
 
+public struct Fuzzilli_Protobuf_BeginFinally {
+  // SwiftProtobuf.Message conformance is added in an extension below. See the
+  // `Message` and `Message+*Additions` files in the SwiftProtobuf library for
+  // methods supported on all messages.
+
+  public var unknownFields = SwiftProtobuf.UnknownStorage()
+
+  public init() {}
+}
+
 public struct Fuzzilli_Protobuf_EndTryCatch {
   // SwiftProtobuf.Message conformance is added in an extension below. See the
   // `Message` and `Message+*Additions` files in the SwiftProtobuf library for
@@ -3414,6 +3424,25 @@ extension Fuzzilli_Protobuf_BeginCatch: SwiftProtobuf.Message, SwiftProtobuf._Me
   }
 }
 
+extension Fuzzilli_Protobuf_BeginFinally: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
+  public static let protoMessageName: String = _protobuf_package + ".BeginFinally"
+  public static let _protobuf_nameMap = SwiftProtobuf._NameMap()
+
+  public mutating func decodeMessage<D: SwiftProtobuf.Decoder>(decoder: inout D) throws {
+    while let _ = try decoder.nextFieldNumber() {
+    }
+  }
+
+  public func traverse<V: SwiftProtobuf.Visitor>(visitor: inout V) throws {
+    try unknownFields.traverse(visitor: &visitor)
+  }
+
+  public static func ==(lhs: Fuzzilli_Protobuf_BeginFinally, rhs: Fuzzilli_Protobuf_BeginFinally) -> Bool {
+    if lhs.unknownFields != rhs.unknownFields {return false}
+    return true
+  }
+}
+
 extension Fuzzilli_Protobuf_EndTryCatch: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding {
   public static let protoMessageName: String = _protobuf_package + ".EndTryCatch"
   public static let _protobuf_nameMap = SwiftProtobuf._NameMap()
diff --git a/Sources/Fuzzilli/Protobuf/operations.proto b/Sources/Fuzzilli/Protobuf/operations.proto
@@ -344,6 +344,9 @@ message BeginTry {
 message BeginCatch {
 }
 
+message BeginFinally {
+}
+
 message EndTryCatch {
 }
 
diff --git a/Sources/Fuzzilli/Protobuf/program.pb.swift b/Sources/Fuzzilli/Protobuf/program.pb.swift
@@ -793,6 +793,14 @@ public struct Fuzzilli_Protobuf_Instruction {
     set {operation = .beginCatch(newValue)}
   }
 
+  public var beginFinally: Fuzzilli_Protobuf_BeginFinally {
+    get {
+      if case .beginFinally(let v)? = operation {return v}
+      return Fuzzilli_Protobuf_BeginFinally()
+    }
+    set {operation = .beginFinally(newValue)}
+  }
+
   public var endTryCatch: Fuzzilli_Protobuf_EndTryCatch {
     get {
       if case .endTryCatch(let v)? = operation {return v}
@@ -935,6 +943,7 @@ public struct Fuzzilli_Protobuf_Instruction {
     case `continue`(Fuzzilli_Protobuf_Continue)
     case beginTry(Fuzzilli_Protobuf_BeginTry)
     case beginCatch(Fuzzilli_Protobuf_BeginCatch)
+    case beginFinally(Fuzzilli_Protobuf_BeginFinally)
     case endTryCatch(Fuzzilli_Protobuf_EndTryCatch)
     case throwException(Fuzzilli_Protobuf_ThrowException)
     case beginCodeString(Fuzzilli_Protobuf_BeginCodeString)
@@ -1277,6 +1286,10 @@ public struct Fuzzilli_Protobuf_Instruction {
         guard case .beginCatch(let l) = lhs, case .beginCatch(let r) = rhs else { preconditionFailure() }
         return l == r
       }()
+      case (.beginFinally, .beginFinally): return {
+        guard case .beginFinally(let l) = lhs, case .beginFinally(let r) = rhs else { preconditionFailure() }
+        return l == r
+      }()
       case (.endTryCatch, .endTryCatch): return {
         guard case .endTryCatch(let l) = lhs, case .endTryCatch(let r) = rhs else { preconditionFailure() }
         return l == r
@@ -1501,6 +1514,7 @@ extension Fuzzilli_Protobuf_Instruction: SwiftProtobuf.Message, SwiftProtobuf._M
     59: .same(proto: "continue"),
     60: .same(proto: "beginTry"),
     61: .same(proto: "beginCatch"),
+    95: .same(proto: "beginFinally"),
     62: .same(proto: "endTryCatch"),
     63: .same(proto: "throwException"),
     81: .same(proto: "beginCodeString"),
@@ -2315,6 +2329,15 @@ extension Fuzzilli_Protobuf_Instruction: SwiftProtobuf.Message, SwiftProtobuf._M
         try decoder.decodeSingularMessageField(value: &v)
         if let v = v {self.operation = .storeSuperProperty(v)}
       }()
+      case 95: try {
+        var v: Fuzzilli_Protobuf_BeginFinally?
+        if let current = self.operation {
+          try decoder.handleConflictingOneOf()
+          if case .beginFinally(let m) = current {v = m}
+        }
+        try decoder.decodeSingularMessageField(value: &v)
+        if let v = v {self.operation = .beginFinally(v)}
+      }()
       default: break
       }
     }
@@ -2684,6 +2707,10 @@ extension Fuzzilli_Protobuf_Instruction: SwiftProtobuf.Message, SwiftProtobuf._M
       guard case .storeSuperProperty(let v)? = self.operation else { preconditionFailure() }
       try visitor.visitSingularMessageField(value: v, fieldNumber: 93)
     }()
+    case .beginFinally?: try {
+      guard case .beginFinally(let v)? = self.operation else { preconditionFailure() }
+      try visitor.visitSingularMessageField(value: v, fieldNumber: 95)
+    }()
     case nil: break
     }
     try unknownFields.traverse(visitor: &visitor)
diff --git a/Sources/Fuzzilli/Protobuf/program.proto b/Sources/Fuzzilli/Protobuf/program.proto
@@ -107,6 +107,7 @@ message Instruction {
         Continue continue = 59;
         BeginTry beginTry = 60;
         BeginCatch beginCatch = 61;
+        BeginFinally beginFinally = 95;
         EndTryCatch endTryCatch = 62;
         ThrowException throwException = 63;
         BeginCodeString beginCodeString = 81;
diff --git a/Tests/FuzzilliTests/LifterTest.swift b/Tests/FuzzilliTests/LifterTest.swift
diff --git a/Tests/FuzzilliTests/XCTestManifests.swift b/Tests/FuzzilliTests/XCTestManifests.swift

Original file line number	Diff line number	Diff line change
`@@ -1261,6 +1261,11 @@ public class ProgramBuilder {`
`1261`	`1261`	`body(exception)`
`1262`	`1262`	`}`
`1263`	`1263`
	`1264`	`+ public func beginFinally(_ body: () -> Void) {`
	`1265`	`+ perform(BeginFinally())`
	`1266`	`+ body()`
	`1267`	`+ }`
	`1268`	`+`
`1264`	`1269`	`public func endTryCatch() {`
`1265`	`1270`	`perform(EndTryCatch())`
`1266`	`1271`	`}`
Original file line number	Diff line number	Diff line change
`@@ -840,6 +840,12 @@ class BeginCatch: ControlFlowOperation {`
`840`	`840`	`}`
`841`	`841`	`}`
`842`	`842`
	`843`	`+class BeginFinally: ControlFlowOperation {`
	`844`	`+ init() {`
	`845`	`+ super.init(numInputs: 0, attributes: [.isBlockBegin, .isBlockEnd])`
	`846`	`+ }`
	`847`	`+}`
	`848`	`+`
`843`	`849`	`class EndTryCatch: ControlFlowOperation {`
`844`	`850`	`init() {`
`845`	`851`	`super.init(numInputs: 0, attributes: [.isBlockEnd])`