googleprojectzero / fuzzilli

A JavaScript Engine Fuzzer
Apache License 2.0
1.86k stars 300 forks source link

Switch Case Problem #441

Open TobiasWienand opened 1 month ago

TobiasWienand commented 1 month ago

Problem:

At the moment we precompute the tests for each switch case and then use the precomputated Variables in each switch case. It would be better to compute the test immediately before making a switch case, however this is not possible because in a Switch block but outside of a switch case there is no javascript context.

Solution Approach:

We could add a SwitchCaseHeader to FuzzIL that opens a javascript context. However this would necessitate changing many files and the payoff for that would only be the ability to correctly compile some very rare and specific cases like the one above. The code above can be used to test if a fix works.

Testbench

A nice illustration for how this problem can manifest can be found here