[js] Register globalThis as a root of all builtins

Change-Id: Iafffa816f1283db25c5254a9229d21b8deb7191d
Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/9645495
Reviewed-by: Olivier Flückiger <olivf@google.com>
Reviewed-by: Leon Bettscheider <bettscheider@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>

Author: Liedtke

Sources/Fuzzilli/Environment/JavaScriptEnvironment.swift

@@ -324,6 +324,7 @@ public class JavaScriptEnvironment: ComponentBase {
     private var builtinTypes: [String: ILType] = [:]
     private var groups: [String: ObjectGroup] = [:]
     private var enums: [String: ILType] = [:]
+    private var globalThisGroup: ObjectGroup
 
     // Producing generators, keyed on `type.group`
     private var producingGenerators:
@@ -361,7 +362,7 @@ public class JavaScriptEnvironment: ComponentBase {
         additionalBuiltins: [String: ILType] = [:], additionalObjectGroups: [ObjectGroup] = [],
         additionalEnumerations: [ILType] = [], additionalOptionsBags: [OptionsBag] = []
     ) {
-
+        self.globalThisGroup = ObjectGroup.jsGlobalThis
         super.init(name: "JavaScriptEnvironment")
 
         // Build model of the JavaScript environment
@@ -767,6 +768,8 @@ public class JavaScriptEnvironment: ComponentBase {
             registerBuiltin(builtin, ofType: type)
         }
 
+        finalizeGlobalThisGroup()
+
         // Add some well-known builtin properties and methods.
         builtinProperties.insert("__proto__")
         builtinProperties.insert("constructor")
@@ -977,11 +980,21 @@ public class JavaScriptEnvironment: ComponentBase {
             })
     }
 
-    public func registerBuiltin(_ name: String, ofType type: ILType) {
+    private func registerBuiltin(_ name: String, ofType type: ILType) {
         assert(builtinTypes[name] == nil)
         builtinTypes[name] = type
         builtins.insert(name)
 
+        globalThisGroup.properties[name] = type
+        if let sig = type.functionSignature ?? type.signature {
+            globalThisGroup.methods[name] = [sig]
+        }
+
+        builtinProperties.insert(name)
+        if type.functionSignature != nil || type.signature != nil {
+            builtinMethods.insert(name)
+        }
+
         let producedType = addProducingProperty(forType: type, by: name, on: "")
         if let groupName = producedType.group {
             if var current = groups[groupName] {
@@ -993,6 +1006,17 @@ public class JavaScriptEnvironment: ComponentBase {
         }
     }
 
+    private func finalizeGlobalThisGroup() {
+        globalThisGroup.instanceType = .object(
+            ofGroup: "GlobalThis",
+            // Sort to ensure deterministic printing of this type.
+            withProperties: Array(globalThisGroup.properties.keys).sorted(),
+            withMethods: Array(globalThisGroup.methods.keys).sorted()
+        )
+        registerBuiltin("globalThis", ofType: globalThisGroup.instanceType)
+        registerObjectGroup(globalThisGroup)
+    }
+
     public func registerOptionsBag(_ bag: OptionsBag) {
         registerObjectGroup(bag.group)
 
@@ -2053,6 +2077,15 @@ extension ObjectGroup {
 //  * "output" type information (properties and return values) should be as precise as possible
 //  * "input" type information (function parameters) should be as broad as possible
 extension ObjectGroup {
+    /// Object group modelling the JavaScript globalThis object.
+    /// Note: The properties and methods are registered dynamically.
+    public static let jsGlobalThis = ObjectGroup(
+        name: "GlobalThis",
+        instanceType: nil,
+        properties: [:],
+        overloads: [:]
+    )
+
     /// Object group modelling JavaScript strings
     public static let jsStrings = ObjectGroup(
         name: "String",

Tests/FuzzilliTests/JSTyperTests.swift

@@ -984,6 +984,65 @@ struct JSTyperTests {
         }
     }
 
+    @Test func testGlobalThisTypeInference() {
+        let env = JavaScriptEnvironment()
+        let fuzzer = makeMockFuzzer(environment: env)
+        fuzzer.sync {
+            let b = fuzzer.makeBuilder()
+            let globalThis = b.createNamedVariable(forBuiltin: "globalThis")
+            #expect(b.type(of: globalThis).properties.contains("Number"))
+            #expect(b.type(of: globalThis).methods.contains("Number"))
+
+            // Property lookups on globalThis
+            let number = b.getProperty("Number", of: globalThis)
+            #expect(b.type(of: number) == .jsNumberConstructor)
+            let math = b.getProperty("Math", of: globalThis)
+            #expect(b.type(of: math) == .jsMathObject)
+            let undefined = b.getProperty("undefined", of: globalThis)
+            #expect(b.type(of: undefined) == .undefined)
+            let isNaNProp = b.getProperty("isNaN", of: globalThis)
+            #expect(b.type(of: isNaNProp) == .jsIsNaNFunction)
+            // globalThis is recursive.
+            let g = b.getProperty("globalThis", of: globalThis)
+            #expect(b.type(of: g) == b.type(of: globalThis))
+
+            // Calling methods on globalThis
+            let res = b.callMethod("isNaN", on: globalThis, withArgs: [b.loadInt(42)])
+            #expect(b.type(of: res) == .boolean)
+        }
+    }
+
+    @Test func testGlobalThisWithAdditionalBuiltins() {
+        let builtinAType = ILType.integer
+        let builtinBType = ILType.object(
+            ofGroup: "B", withProperties: ["foo", "bar"], withMethods: ["m1", "m2"])
+        let builtinCType = ILType.function([] => .number)
+
+        let env = JavaScriptEnvironment(additionalBuiltins: [
+            "A": builtinAType,
+            "B": builtinBType,
+            "C": builtinCType,
+        ])
+
+        let fuzzer = makeMockFuzzer(environment: env)
+        fuzzer.sync {
+            let b = fuzzer.makeBuilder()
+            let globalThis = b.createNamedVariable(forBuiltin: "globalThis")
+
+            let a = b.getProperty("A", of: globalThis)
+            #expect(b.type(of: a) == builtinAType)
+            let bObj = b.getProperty("B", of: globalThis)
+            #expect(b.type(of: bObj) == builtinBType)
+            let cFunc = b.getProperty("C", of: globalThis)
+            #expect(b.type(of: cFunc) == builtinCType)
+            let cCall = b.callMethod("C", on: globalThis, withArgs: [])
+            #expect(b.type(of: cCall) == .number)
+            // globalThis is recursive including the additional properties.
+            let g = b.getProperty("globalThis", of: globalThis)
+            #expect(b.type(of: g) == b.type(of: globalThis))
+        }
+    }
+
     @Test func testPropertyTypeInference() {
         let propFooType = ILType.float
         let propBarType = ILType.function([] => .jsAnything)