googleprojectzero / googleprojectzero/fuzzilli
FuzzILTool Error
Open
Nobody has claimed this yet.
- Dominant language
- Swift
- Stars
- 2.3k
- Forks
- 367
- Avg merge
- 23h 53m
- Merged PRs (30d)
- 1
Description
I have a JavaScript file:
let a = function() {
return {}
};
for (let j = 0; j < 999; j++) {
((a = class b3 {[{c: eval()}]}) => {})();
if (j == 8) {
a();
}
}
I want to compile it into a .fzil file, but I encountered an error:
>swift run -c release FuzzILTool --compile ./tmp/tmp.js
Building for production...
Build complete! (0.18s)
Failed to parse ./tmp/tmp.js: parsingFailed("\n/home/fuzzer/myspace/tools/fuzzilli/.build/x86_64-unknown-linux-gnu/release/Fuzzilli_Fuzzilli.resources/Parser/parser.js:19\n throw \"Assertion failed\";\n ^\nAssertion failed\n(Use `node --trace-uncaught ...` to show where the exception was thrown)\n")
When I remove the line ((a = class b3 {[{c: eval()}]}) => {})();, it compiles successfully. However, I cannot remove this line.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the failure with FuzzILTool --compile ./tmp/tmp.js using the JavaScript snippet in the report. Start at the parser failure reported in parser.js:19 and trace how the ((a = class b3 {[{c: eval()}]}) => {})(); expression is handled. Done means the reproducer compiles into a .fzil file without the assertion failure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, swift
- Domain
- compilers, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100