googleprojectzero / googleprojectzero/fuzzilli
Consider introducing `reassignedInputs` section of an Instruction's inouts
Nobody has claimed this yet.
- Dominant language
- Swift
- Stars
- 2.3k
- Forks
- 367
- Avg merge
- 23h 53m
- Merged PRs (30d)
- 1
Description
A FuzzIL instruction contains a list of inputs and outputs: the inouts array. Currently, the list if divided into three segments: inputs, outputs, and innerOutputs (outputs visible in a newly created scope). Outputs must be new variables, but we support reassigning existing variables (for example with the Reassign operation but also others). This works simply by passing them as inputs, and so reassigned inputs and read-only inputs are not easily distinguished. For that reason, we currently need some extra function to tell us if an input is reassigned.
I think instead of this, it could be much nicer and more robust if we added a new section to the inouts: reassignedInputs. That makes it immediately clear that these must be existing variables and that they will be reassigned. To ease the transition, we probably first want to rename .inputs to .allInputs and switch all callsites to that, then introduce .reassignedInputs and .inputs (or even .readOnlyInputs to make the distinction even more clear) and use them where appropriate.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the inouts definition in Sources/Fuzzilli/FuzzIL/Instruction.swift, then inspect the Reassign operation in JsOperations.swift and the reassignment helper in Semantics.swift. Search the repository for .inputs and its callsites to map the transition; done means reassigned and read-only inputs are represented distinctly without breaking existing instruction handling.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, swift
- Domain
- compilers
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100