As far as I'm aware, currently the only way to add additional ObjectGroups to the JS environment requires maintaining a separate fork of Fuzzilli. I thought allowing users of Fuzzilli to supply additional ObjectGroups in their Profiles would remove the need to maintain a separate fork to have a different JS environment from the main branch of Fuzzilli.
An example of a fork that could've benefited from this change is fuzzilli4wasm
As far as I'm aware, currently the only way to add additional ObjectGroups to the JS environment requires maintaining a separate fork of Fuzzilli. I thought allowing users of Fuzzilli to supply additional ObjectGroups in their Profiles would remove the need to maintain a separate fork to have a different JS environment from the main branch of Fuzzilli.
An example of a fork that could've benefited from this change is fuzzilli4wasm
Example use case
For Hermes, we want to fuzz the TextEncoder web API (https://github.com/facebook/hermes/commit/3863a36a53005dd1e6d39ea0d4ef5573bafde910, https://github.com/facebook/hermes/commit/7f9d9d5e44e2df5170f33d1604bea3b085f40e39, https://github.com/facebook/hermes/commit/14790c925cadce5eff7e604d7640d6d5451fb7cc):
Test plan
Fuzzilli.JavaScriptEnvironment.groups
andFuzzilli.JavaScriptEnvironment.builtinTypes
access control modifiers fromprivate
topublic
environment.groups
andenvironment.builtinTypes
in FuzzilliCli/main.swiftswift run FuzzilliCli --profile=hermes ../fuzzilli_build/bin/fuzzilli --storagePath=./corpus --logLevel=verbose
TextEncoder
is in the output forenvironment.groups
andenvironment.builtinTypes