googleprojectzero / googleprojectzero/fuzzilli

Experiment with JavaScriptLifter inlining heuristic that tries to avoid additional brackets

Open
#491 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Swift
Stars
2.3k
Forks
367
Avg merge
23h 53m
Merged PRs (30d)
1

Description

Currently, the JavaScriptLifter is fairly "greedy" about its inlining decisions and mostly inlines expressions whenever possible:

  1. There is a single use of the produced value (or if the expression is pure)
  2. There is no other effectful operation between the operation that produced the expression and the operation using the value (otherwise, inlining would change the semantics of the program)

However, this can lead to somewhat hard to read code. For example things such as

print((new X).a);

or

("1234").foobar();

Currently we manually try to avoid some of these patterns, for example by forcing the constructor value to be an identifier for a construct call. However it could be the case that a simple heuristic would also work here instead of a manual "denylist": we avoid inlining if we would require additional brackets (such as in the examples above). Maybe for arithmetic operations we allow adding brackets, but forbid them for other expressions and instead force the creation of a new variable. Ideally, we would design the new algorithm in a way that also allows us to remove the somewhat awkward logic for expression un-inlining.

I think it would be worth experimenting with such a heuristic to see how the generated samples look like.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Read Sources/Fuzzilli/Lifting/JavaScriptLifter.swift, including the constructor inlining logic near line 774 and expression un-inlining logic near line 1694. Experiment with a heuristic that avoids inlining when additional brackets would be needed, while considering arithmetic expressions separately. Done means generated samples are easier to read and the awkward un-inlining logic can potentially be removed.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, swift
Domain
devtools
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.