Switch Case Problem

Problem:

At the moment we precompute the tests for each switch case and then use the precomputated Variables in each switch case. It would be better to compute the test immediately before making a switch case, however this is not possible because in a Switch block but outside of a switch case there is no javascript context.

Solution Approach:

We could add a SwitchCaseHeader to FuzzIL that opens a javascript context. However this would necessitate changing many files and the payoff for that would only be the ability to correctly compile some very rare and specific cases like the one above. The code above can be used to test if a fix works.

Testbench

A nice illustration for how this problem can manifest can be found here

Start by reviewing the linked Fuzzilli pull request discussion and the switch-case testbench described in the issue. Then trace how FuzzIL represents and compiles switch blocks and cases. Done means the specific rare case can compute its test immediately before entering the switch case while retaining the required JavaScript context.