feature/loop without var decl

Sources/Fuzzilli/Base/ProgramBuilder.swift

@@ -2501,19 +2501,41 @@ public class ProgramBuilder {
         emit(EndForLoop())
     }
 
-    public func buildForInLoop(_ obj: Variable, _ body: (Variable) -> ()) {
-        let i = emit(BeginForInLoop(), withInputs: [obj]).innerOutput
+    public func buildPlainForInLoop(_ obj: Variable, _ name: String, declarationMode: NamedVariableDeclarationMode, _ body: (Variable) -> ()) {
+        let i: Variable
+        if declarationMode == .let || declarationMode == .const {
+            i = emit(BeginPlainForInLoop(name, declarationMode: declarationMode), withInputs: [obj]).innerOutput
+        } else {
+            i = emit(BeginPlainForInLoop(name, declarationMode: declarationMode), withInputs: [obj]).output
+        }
         body(i)
         emit(EndForInLoop())
     }
 
-    public func buildForOfLoop(_ obj: Variable, _ body: (Variable) -> ()) {
-        let i = emit(BeginForOfLoop(), withInputs: [obj]).innerOutput
+    public func buildForInLoopWithReassignment(_ obj: Variable, _ existingVar: Variable, _ body: () -> ()) {
+        emit(BeginForInLoopWithReassignment(), withInputs: [obj, existingVar])
+        body()
+        emit(EndForInLoop())
+    }
+
+    public func buildPlainForOfLoop(_ obj: Variable, _ name: String, declarationMode: NamedVariableDeclarationMode, _ body: (Variable) -> ()) {
+        let i: Variable
+        if declarationMode == .let || declarationMode == .const {
+            i = emit(BeginPlainForOfLoop(name, declarationMode: declarationMode), withInputs: [obj]).innerOutput
+        } else {
+            i = emit(BeginPlainForOfLoop(name, declarationMode: declarationMode), withInputs: [obj]).output
+        }
         body(i)
         emit(EndForOfLoop())
     }
 
-    public func buildForOfLoop(_ obj: Variable, selecting indices: [Int64], hasRestElement: Bool = false, _ body: ([Variable]) -> ()) {
+    public func buildForOfLoopWithReassignment(_ obj: Variable, _ existingVar: Variable, _ body: () -> ()) {
+        emit(BeginForOfLoopWithReassignment(), withInputs: [obj, existingVar])
+        body()
+        emit(EndForOfLoop())
+    }
+
+    public func buildForOfLoopWithDestruct(_ obj: Variable, selecting indices: [Int64], hasRestElement: Bool = false, _ body: ([Variable]) -> ()) {
         let instr = emit(BeginForOfLoopWithDestruct(indices: indices, hasRestElement: hasRestElement), withInputs: [obj])
         body(Array(instr.innerOutputs))
         emit(EndForOfLoop())

Sources/Fuzzilli/CodeGen/CodeGeneratorWeights.swift

@@ -159,8 +159,10 @@ public let codeGeneratorWeights = [
     "DoWhileLoopGenerator":                     15,
     "SimpleForLoopGenerator":                   10,
     "ComplexForLoopGenerator":                  10,
-    "ForInLoopGenerator":                       10,
-    "ForOfLoopGenerator":                       10,
+    "PlainForInLoopGenerator":                  8,
+    "ForInLoopWithReassignmentGenerator":       2,
+    "PlainForOfLoopGenerator":                  8,
+    "ForOfLoopWithReassignmentGenerator":       2,
     "ForOfWithDestructLoopGenerator":           3,
     "RepeatLoopGenerator":                      10,
     "SwitchCaseBreakGenerator":                 5,

Sources/Fuzzilli/CodeGen/CodeGenerators.swift

@@ -1420,14 +1420,36 @@ public let CodeGenerators: [CodeGenerator] = [
         }
     },
 
-    RecursiveCodeGenerator("ForInLoopGenerator", inputs: .preferred(.object())) { b, obj in
-        b.buildForInLoop(obj) { _ in
+    RecursiveCodeGenerator("PlainForInLoopGenerator", inputs: .preferred(.object())) { b, obj in
+        // .none declaration mode is for reassigning loops
+        let validDeclarationModes = NamedVariableDeclarationMode.allCases.filter { $0 != .none }
+        let name = b.randomCustomPropertyName()
+        let declarationMode = chooseUniform(from: NamedVariableDeclarationMode.allCases)
+        b.buildPlainForInLoop(obj, name, declarationMode: declarationMode) { _ in
+            b.buildRecursive()
+        }
+    },
+
+    RecursiveCodeGenerator("ForInLoopWithReassignmentGenerator", inputs: .preferred(.object())) { b, obj in
+        // use a pre-declared variable as the iterator variable (i.e., reassign it)
+        let existing = b.randomVariable()
+        b.buildForInLoopWithReassignment(obj, existing) {
+            b.buildRecursive()
+        }
+    },
+
+    RecursiveCodeGenerator("PlainForOfLoopGenerator", inputs: .preferred(.iterable)) { b, obj in
+        let validDeclarationModes = NamedVariableDeclarationMode.allCases.filter { $0 != .none }
+        let name = b.randomCustomPropertyName()
+        let declarationMode = chooseUniform(from: NamedVariableDeclarationMode.allCases)
+        b.buildPlainForOfLoop(obj, name, declarationMode: declarationMode) { _ in
             b.buildRecursive()
         }
     },
 
-    RecursiveCodeGenerator("ForOfLoopGenerator", inputs: .preferred(.iterable)) { b, obj in
-        b.buildForOfLoop(obj) { _ in
+    RecursiveCodeGenerator("ForOfLoopWithReassignmentGenerator", inputs: .preferred(.iterable)) { b, obj in
+        let existing = b.randomVariable()
+        b.buildForOfLoopWithReassignment(obj, existing) {
             b.buildRecursive()
         }
     },
@@ -1444,7 +1466,7 @@ public let CodeGenerators: [CodeGenerator] = [
             indices = [0]
         }
 
-        b.buildForOfLoop(obj, selecting: indices, hasRestElement: probability(0.2)) { _ in
+        b.buildForOfLoopWithDestruct(obj, selecting: indices, hasRestElement: probability(0.2)) { _ in
             b.buildRecursive()
         }
     },

Sources/Fuzzilli/Compiler/Compiler.swift

@@ -417,36 +417,117 @@ public class JavaScriptCompiler {
             emit(EndForLoop())
 
         case .forInLoop(let forInLoop):
-            let initializer = forInLoop.left;
-            guard !initializer.hasValue else {
-                throw CompilerError.invalidNodeError("Expected no initial value for the variable declared in a for-in loop")
-            }
-
+            let initializer = forInLoop.left!
             let obj = try compileExpression(forInLoop.right)
+            // Processing a for-in or for-of loop requires an iterator, which is typically declared in the function header.
+            // Alternatively, an existing variable can be used, resulting in an identifier instead of a variable declarator.
+            // If the identifier is not previously declared, it is implicitly created as a global variable.
+
+            switch initializer {
+            case .variableDeclaration(let variableDeclaration):
+                guard variableDeclaration.declarations.count == 1 else {
+                    throw CompilerError.invalidNodeError("Expected only one variable to be declared in a for-in loop")
+                }
+                let decl = variableDeclaration.declarations[0]
+                guard !decl.hasValue else {
+                    throw CompilerError.invalidNodeError("Expected no initial value for the variable declared in a for-in loop")
+                } 
+                let kind: NamedVariableDeclarationMode
+                switch variableDeclaration.kind {
+                case .var:
+                    kind = .var
+                case .let:
+                    kind = .let
+                case .const:
+                    kind = .const
+                case .UNRECOGNIZED(let type):
+                    throw CompilerError.invalidNodeError("invalid variable declaration type \(type)")
+                }
+                let newVariableName = decl.name
+                let loopVar : Variable
+                if kind == .const || kind == .let {
+                    loopVar = emit(BeginPlainForInLoop(newVariableName, declarationMode: kind), withInputs: [obj]).innerOutput
+                    try enterNewScope {
+                        map(newVariableName, to: loopVar)
+                        try compileBody(forInLoop.body)
+                    }
+                } else {
+                    loopVar = emit(BeginPlainForInLoop(newVariableName, declarationMode: kind), withInputs: [obj]).output
+                    map(newVariableName, to: loopVar)
+                    try enterNewScope {
+                        try compileBody(forInLoop.body)
+                    }
+                }
+                emit(EndForInLoop())
 
-            let loopVar = emit(BeginForInLoop(), withInputs: [obj]).innerOutput
-            try enterNewScope {
-                map(initializer.name, to: loopVar)
-                try compileBody(forInLoop.body)
+            case .identifier(let identifier):
+                if let pre_existing_variable = lookupIdentifier(identifier.name) {
+                    emit(BeginForInLoopWithReassignment(), withInputs: [obj, pre_existing_variable])
+                } else {
+                    // A for-in loop with an identifier that is not previously declared is implicitly a global variable.
+                    let new_global_iterator = emit(BeginPlainForInLoop(identifier.name, declarationMode: .global), withInputs: [obj]).output
+                    map(identifier.name, to: new_global_iterator)
+                }
+                try enterNewScope {
+                    try compileBody(forInLoop.body)
+                }
+                emit(EndForInLoop())
             }
 
-            emit(EndForInLoop())
-
         case .forOfLoop(let forOfLoop):
-            let initializer = forOfLoop.left;
-            guard !initializer.hasValue else {
-                throw CompilerError.invalidNodeError("Expected no initial value for the variable declared in a for-of loop")
-            }
-
+            let initializer = forOfLoop.left!
             let obj = try compileExpression(forOfLoop.right)
 
-            let loopVar = emit(BeginForOfLoop(), withInputs: [obj]).innerOutput
-            try enterNewScope {
-                map(initializer.name, to: loopVar)
-                try compileBody(forOfLoop.body)
-            }
+            switch initializer {
+            case .variableDeclaration(let variableDeclaration):
+                guard variableDeclaration.declarations.count == 1 else {
+                    throw CompilerError.invalidNodeError("Expected only one variable to be declared in a for-of loop")
+                }
+                let decl = variableDeclaration.declarations[0]
+                guard !decl.hasValue else {
+                    throw CompilerError.invalidNodeError("Expected no initial value for the variable declared in a for-of loop")
+                } 
+                let kind: NamedVariableDeclarationMode
+                switch variableDeclaration.kind {
+                case .var:
+                    kind = .var
+                case .let:
+                    kind = .let
+                case .const:
+                    kind = .const
+                case .UNRECOGNIZED(let type):
+                    throw CompilerError.invalidNodeError("invalid variable declaration type \(type)")
+                }
+                let newVariableName = decl.name
+                let loopVar : Variable
+                if kind == .const || kind == .let {
+                    loopVar = emit(BeginPlainForOfLoop(newVariableName, declarationMode: kind), withInputs: [obj]).innerOutput
+                    try enterNewScope {
+                        map(newVariableName, to: loopVar)
+                        try compileBody(forOfLoop.body)
+                    }
+                } else {
+                    loopVar = emit(BeginPlainForOfLoop(newVariableName, declarationMode: kind), withInputs: [obj]).output
+                    map(newVariableName, to: loopVar)
+                    try enterNewScope {
+                        try compileBody(forOfLoop.body)
+                    }
+                }
+                emit(EndForOfLoop())
 
-            emit(EndForOfLoop())
+            case .identifier(let identifier):
+                if let pre_existing_variable = lookupIdentifier(identifier.name) {
+                    emit(BeginForOfLoopWithReassignment(), withInputs: [obj, pre_existing_variable])
+                } else {
+                    // A for-of loop with an identifier that is not previously declared is implicitly a global variable.
+                    let new_global_iterator = emit(BeginPlainForOfLoop(identifier.name, declarationMode: .global), withInputs: [obj]).output
+                    map(identifier.name, to: new_global_iterator)
+                }
+                try enterNewScope {
+                    try compileBody(forOfLoop.body)
+                }
+                emit(EndForOfLoop())
+            }
 
         case .breakStatement:
             // If we're in both .loop and .switch context, then the loop must be the most recent context 
@@ -597,7 +678,6 @@ public class JavaScriptCompiler {
             let v = emit(CreateNamedVariable(identifier.name, declarationMode: .none)).output
             // Cache the variable in case it is reused again to avoid emitting multiple
             // CreateNamedVariable operations for the same variable.
-            map(identifier.name, to: v)
             return v
 
         case .numberLiteral(let literal):
@@ -722,13 +802,15 @@ public class JavaScriptCompiler {
             case .identifier(let identifier):
                 // Try to lookup the variable belonging to the identifier. If there is none, we're (probably) dealing with
                 // an access to a global variable/builtin or a hoisted variable access. In the case, create a named variable.
-                let lhs = lookupIdentifier(identifier.name) ?? emit(CreateNamedVariable(identifier.name, declarationMode: .none)).output
+                guard let lhs = lookupIdentifier(identifier.name) else {
+                    let lhs = emit(CreateNamedVariable(identifier.name, declarationMode: .global), withInputs: [rhs]).output
+                    map(identifier.name, to: lhs)
+                    break
+                }
 
                 // Compile to a Reassign or Update operation
                 switch assignmentExpression.operator {
                 case "=":
-                    // TODO(saelo): if we're assigning to a named variable, we could also generate a declaration
-                    // of a global variable here instead. Probably it doeesn't matter in practice though.
                     emit(Reassign(), withInputs: [lhs, rhs])
                 default:
                     // It's something like "+=", "-=", etc.

Sources/Fuzzilli/Compiler/Parser/parser.js

@@ -11,6 +11,12 @@ let astProtobufDefinitionPath = process.argv[2];
 let inputFilePath = process.argv[3];
 let outputFilePath = process.argv[4];
 
+const varKindMap = {
+    "var": 0,
+    "let": 1,
+    "const": 2
+};
+
 function assert(cond, msg) {
     if (!cond) {
         if (typeof msg !== 'undefined') {
@@ -97,15 +103,9 @@ function parse(script, proto) {
     }
 
     function visitVariableDeclaration(node) {
-        let kind;
-        if (node.kind === "var") {
-            kind = 0;
-        } else if (node.kind === "let") {
-            kind = 1;
-        } else if (node.kind === "const") {
-            kind = 2;
-        } else {
-            throw "Unknown variable declaration kind: " + node.kind;
+        let kind = varKindMap[node.kind];
+        if (kind === undefined) {
+            throw new Error("Unknown variable declaration kind: " + node.kind);
         }
 
         let declarations = [];
@@ -282,25 +282,53 @@ function parse(script, proto) {
                 return makeStatement('ForLoop', forLoop);
             }
             case 'ForInStatement': {
-                assert(node.left.type === 'VariableDeclaration', "Expected variable declaration as init part of a for-in loop, found " + node.left.type);
-                assert(node.left.declarations.length === 1, "Expected exactly one variable declaration in the init part of a for-in loop");
-                let decl = node.left.declarations[0];
                 let forInLoop = {};
-                let initDecl = { name: decl.id.name };
-                assert(decl.init == null, "Expected no initial value for the variable declared as part of a for-in loop")
-                forInLoop.left = make('VariableDeclarator', initDecl);
+                if (node.left.type === 'VariableDeclaration') {
+                    assert(node.left.declarations.length === 1, "Expected exactly one variable declaration in the init part of a for-in loop");
+                    let decl = node.left.declarations[0];
+                    let initDecl = { name: decl.id.name };
+                    assert(decl.init == null, "Expected no initial value for the variable declared as part of a for-in loop")
+                    // TODO: Support destructuring / member expressions
+                    assert(decl.id.type == "Identifier", "Expected identifier for the variable declared as part of a for-in loop")
+                    let kind = varKindMap[node.left.kind];
+                    if (kind === undefined) {
+                        throw new Error("Unknown variable declaration kind: " + node.kind);
+                    }
+                    forInLoop.variableDeclaration = make('VariableDeclaration', {
+                        kind: kind,
+                        declarations: [initDecl]
+                    });
+                } else if (node.left.type === 'Identifier') {
+                    forInLoop.identifier = make('Identifier', { name: node.left.name });
+                } else {
+                    throw "Unsupported left side of for-in loop: " + node.left.type;
+                }
                 forInLoop.right = visitExpression(node.right);
                 forInLoop.body = visitStatement(node.body);
                 return makeStatement('ForInLoop', forInLoop);
             }
             case 'ForOfStatement': {
-                assert(node.left.type === 'VariableDeclaration', "Expected variable declaration as init part of a for-in loop, found " + node.left.type);
-                assert(node.left.declarations.length === 1, "Expected exactly one variable declaration in the init part of a for-in loop");
-                let decl = node.left.declarations[0];
                 let forOfLoop = {};
-                let initDecl = { name: decl.id.name };
-                assert(decl.init == null, "Expected no initial value for the variable declared as part of a for-in loop")
-                forOfLoop.left = make('VariableDeclarator', initDecl);
+                if (node.left.type === 'VariableDeclaration') {
+                    assert(node.left.declarations.length === 1, "Expected exactly one variable declaration in the init part of a for-of loop");
+                    let decl = node.left.declarations[0];
+                    let initDecl = { name: decl.id.name };
+                    assert(decl.init == null, "Expected no initial value for the variable declared as part of a for-of loop")
+                    // TODO: Support destructuring / member expressions
+                    assert(decl.id.type == "Identifier", "Expected identifier for the variable declared as part of a for-of loop")
+                    let kind = varKindMap[node.left.kind];
+                    if (kind === undefined) {
+                        throw new Error("Unknown variable declaration kind: " + node.kind);
+                    }
+                    forOfLoop.variableDeclaration = make('VariableDeclaration', {
+                        kind: kind,
+                        declarations: [initDecl]
+                    });
+                } else if (node.left.type === 'Identifier') {
+                    forOfLoop.identifier = make('Identifier', { name: node.left.name });
+                } else {
+                    throw "Unsupported left side of for-of loop: " + node.left.type;
+                }
                 forOfLoop.right = visitExpression(node.right);
                 forOfLoop.body = visitStatement(node.body);
                 return makeStatement('ForOfLoop', forOfLoop);