googleprojectzero / googleprojectzero/fuzzilli

Consider introducing `reassignedInputs` section of an Instruction's inouts

Open
#492 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Swift
Stars
2.3k
Forks
367
Avg merge
23h 53m
Merged PRs (30d)
1

Description

A FuzzIL instruction contains a list of inputs and outputs: the inouts array. Currently, the list if divided into three segments: inputs, outputs, and innerOutputs (outputs visible in a newly created scope). Outputs must be new variables, but we support reassigning existing variables (for example with the Reassign operation but also others). This works simply by passing them as inputs, and so reassigned inputs and read-only inputs are not easily distinguished. For that reason, we currently need some extra function to tell us if an input is reassigned.

I think instead of this, it could be much nicer and more robust if we added a new section to the inouts: reassignedInputs. That makes it immediately clear that these must be existing variables and that they will be reassigned. To ease the transition, we probably first want to rename .inputs to .allInputs and switch all callsites to that, then introduce .reassignedInputs and .inputs (or even .readOnlyInputs to make the distinction even more clear) and use them where appropriate.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the inouts definition in Sources/Fuzzilli/FuzzIL/Instruction.swift, then inspect the Reassign operation in JsOperations.swift and the reassignment helper in Semantics.swift. Search the repository for .inputs and its callsites to map the transition; done means reassigned and read-only inputs are represented distinctly without breaking existing instruction handling.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, swift
Domain
compilers
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.