Skip to content

Commit e174d6f

Browse files
linusglinusg
committed
Add more recent builtin additions
Adds builtins from the following stage 4 proposals: - https://github.com/tc39/proposal-array-from-async - https://github.com/tc39/proposal-float16array - https://github.com/tc39/proposal-math-sum - https://github.com/tc39/proposal-promise-try - https://github.com/tc39/proposal-regex-escaping
1 parent 4ac378c commit e174d6f

File tree

1 file changed

+67
-46
lines changed

1 file changed

+67
-46
lines changed

‎Sources/Fuzzilli/Environment/JavaScriptEnvironment.swift‎

Lines changed: 67 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ public class JavaScriptEnvironment: ComponentBase {
2121
// TODO: use it in all places where it can be used.
2222
public static let typedArrayConstructors = [
2323
"Uint8Array", "Int8Array", "Uint16Array", "Int16Array",
24-
"Uint32Array", "Int32Array", "Float32Array", "Float64Array",
24+
"Uint32Array", "Int32Array", "Float16Array", "Float32Array", "Float64Array",
2525
"Uint8ClampedArray", "BigInt64Array", "BigUint64Array",
2626
]
2727

@@ -345,7 +345,7 @@ public class JavaScriptEnvironment: ComponentBase {
345345
registerObjectGroup(.jsFinalizationRegistrys)
346346
registerObjectGroup(.jsArrayBuffers)
347347
registerObjectGroup(.jsSharedArrayBuffers)
348-
for variant in ["Uint8Array", "Int8Array", "Uint16Array", "Int16Array", "Uint32Array", "Int32Array", "Float32Array", "Float64Array", "Uint8ClampedArray", "BigInt64Array", "BigUint64Array"] {
348+
for variant in ["Uint8Array", "Int8Array", "Uint16Array", "Int16Array", "Uint32Array", "Int32Array", "Float16Array", "Float32Array", "Float64Array", "Uint8ClampedArray", "BigInt64Array", "BigUint64Array"] {
349349
registerObjectGroup(.jsTypedArrays(variant))
350350
}
351351
registerObjectGroup(.jsUint8ArrayConstructor)
@@ -360,6 +360,7 @@ public class JavaScriptEnvironment: ComponentBase {
360360
registerObjectGroup(.jsStringPrototype)
361361
registerObjectGroup(.jsSymbolConstructor)
362362
registerObjectGroup(.jsBigIntConstructor)
363+
registerObjectGroup(.jsRegExpConstructor)
363364
registerObjectGroup(.jsBooleanConstructor)
364365
registerObjectGroup(.jsNumberConstructor)
365366
registerObjectGroup(.jsMathObject)
@@ -581,7 +582,7 @@ public class JavaScriptEnvironment: ComponentBase {
581582
registerBuiltin("ArrayBuffer", ofType: .jsArrayBufferConstructor)
582583
registerBuiltin("SharedArrayBuffer", ofType: .jsSharedArrayBufferConstructor)
583584
// Uint8Array handled below.
584-
for variant in ["Int8Array", "Uint16Array", "Int16Array", "Uint32Array", "Int32Array", "Float32Array", "Float64Array", "Uint8ClampedArray", "BigInt64Array", "BigUint64Array"] {
585+
for variant in ["Int8Array", "Uint16Array", "Int16Array", "Uint32Array", "Int32Array", "Float16Array", "Float32Array", "Float64Array", "Uint8ClampedArray", "BigInt64Array", "BigUint64Array"] {
585586
registerBuiltin(variant, ofType: .jsTypedArrayConstructor(variant))
586587
}
587588
registerBuiltin("Uint8Array", ofType: .jsUint8ArrayConstructor)
@@ -1069,7 +1070,7 @@ public extension ILType {
10691070
static let jsSharedArrayBuffer = ILType.object(ofGroup: "SharedArrayBuffer", withProperties: ["byteLength", "maxByteLength", "growable"], withMethods: ["grow", "slice"])
10701071

10711072
/// Type of a JavaScript DataView object.
1072-
static let jsDataView = ILType.object(ofGroup: "DataView", withProperties: ["buffer", "byteLength", "byteOffset"], withMethods: ["getInt8", "getUint8", "getInt16", "getUint16", "getInt32", "getUint32", "getFloat32", "getFloat64", "getBigInt64", "setInt8", "setUint8", "setInt16", "setUint16", "setInt32", "setUint32", "setFloat32", "setFloat64", "setBigInt64"])
1073+
static let jsDataView = ILType.object(ofGroup: "DataView", withProperties: ["buffer", "byteLength", "byteOffset"], withMethods: ["getInt8", "getUint8", "getInt16", "getUint16", "getInt32", "getUint32", "getFloat16", "getFloat32", "getFloat64", "getBigInt64", "setInt8", "setUint8", "setInt16", "setUint16", "setInt32", "setUint32", "setFloat16", "setFloat32", "setFloat64", "setBigInt64"])
10731074

10741075
/// Type of a JavaScript TypedArray object of the given variant.
10751076
static func jsTypedArray(_ variant: String) -> ILType {
@@ -1090,7 +1091,7 @@ public extension ILType {
10901091
static let jsObjectConstructor = .functionAndConstructor([.jsAnything...] => .object()) + .object(ofGroup: "ObjectConstructor", withProperties: ["prototype"], withMethods: ["assign", "fromEntries", "getOwnPropertyDescriptor", "getOwnPropertyDescriptors", "getOwnPropertyNames", "getOwnPropertySymbols", "is", "preventExtensions", "seal", "create", "defineProperties", "defineProperty", "freeze", "getPrototypeOf", "setPrototypeOf", "isExtensible", "isFrozen", "isSealed", "keys", "entries", "values"])
10911092

10921093
/// Type of the JavaScript Array constructor builtin.
1093-
static let jsArrayConstructor = .functionAndConstructor([.integer] => .jsArray) + .object(ofGroup: "ArrayConstructor", withProperties: ["prototype"], withMethods: ["from", "of", "isArray"])
1094+
static let jsArrayConstructor = .functionAndConstructor([.integer] => .jsArray) + .object(ofGroup: "ArrayConstructor", withProperties: ["prototype"], withMethods: ["from", "fromAsync", "of", "isArray"])
10941095

10951096
/// Type of the JavaScript Function constructor builtin.
10961097
static let jsFunctionConstructor = ILType.constructor([.string] => .jsFunction(Signature.forUnknownFunction))
@@ -1111,7 +1112,7 @@ public extension ILType {
11111112
static let jsBigIntConstructor = ILType.function([.number] => .bigint) + .object(ofGroup: "BigIntConstructor", withProperties: ["prototype"], withMethods: ["asIntN", "asUintN"])
11121113

11131114
/// Type of the JavaScript RegExp constructor builtin.
1114-
static let jsRegExpConstructor = ILType.jsFunction([.string] => .jsRegExp)
1115+
static let jsRegExpConstructor = ILType.functionAndConstructor([.string] => .jsRegExp) + .object(ofGroup: "RegExpConstructor", withProperties: ["prototype"], withMethods: ["escape"])
11151116

11161117
/// Type of a JavaScript Error object of the given variant.
11171118
static func jsError(_ variant: String) -> ILType {
@@ -1120,6 +1121,7 @@ public extension ILType {
11201121

11211122
/// Type of the JavaScript Error constructor builtin
11221123
static func jsErrorConstructor(_ variant: String) -> ILType {
1124+
// TODO: Add `Error.isError()`
11231125
return .functionAndConstructor([.opt(.string)] => .jsError(variant))
11241126
}
11251127

@@ -1142,7 +1144,7 @@ public extension ILType {
11421144
static let jsDataViewConstructor = ILType.constructor([.plain(.jsArrayBuffer), .opt(.integer), .opt(.integer)] => .jsDataView)
11431145

11441146
/// Type of the JavaScript Promise constructor builtin.
1145-
static let jsPromiseConstructor = ILType.constructor([.function()] => .jsPromise) + .object(ofGroup: "PromiseConstructor", withProperties: ["prototype"], withMethods: ["resolve", "reject", "all", "any", "race", "allSettled"])
1147+
static let jsPromiseConstructor = ILType.constructor([.function()] => .jsPromise) + .object(ofGroup: "PromiseConstructor", withProperties: ["prototype"], withMethods: ["resolve", "reject", "all", "any", "race", "allSettled", "try"])
11461148

11471149
/// Type of the JavaScript Proxy constructor builtin.
11481150
static let jsProxyConstructor = ILType.constructor([.object(), .object()] => .jsAnything)
@@ -1166,7 +1168,7 @@ public extension ILType {
11661168
static let jsFinalizationRegistryConstructor = ILType.constructor([.function()] => .jsFinalizationRegistry)
11671169

11681170
/// Type of the JavaScript Math constructor builtin.
1169-
static let jsMathObject = ILType.object(ofGroup: "Math", withProperties: ["E", "PI"], withMethods: ["abs", "acos", "acosh", "asin", "asinh", "atan", "atanh", "atan2", "ceil", "cbrt", "expm1", "clz32", "cos", "cosh", "exp", "floor", "fround", "hypot", "imul", "log", "log1p", "log2", "log10", "max", "min", "pow", "random", "round", "sign", "sin", "sinh", "sqrt", "tan", "tanh", "trunc"])
1171+
static let jsMathObject = ILType.object(ofGroup: "Math", withProperties: ["E", "PI"], withMethods: ["abs", "acos", "acosh", "asin", "asinh", "atan", "atanh", "atan2", "ceil", "cbrt", "expm1", "clz32", "cos", "cosh", "exp", "floor", "fround", "f16round", "hypot", "imul", "log", "log1p", "log2", "log10", "max", "min", "pow", "random", "round", "sign", "sin", "sinh", "sqrt", "sumPrecise", "tan", "tanh", "trunc"])
11701172

11711173
/// Type of the JavaScript Date object
11721174
static let jsDate = ILType.object(ofGroup: "Date", withMethods: ["toISOString", "toDateString", "toTimeString", "toLocaleString", "getTime", "getFullYear", "getUTCFullYear", "getMonth", "getUTCMonth", "getDate", "getUTCDate", "getDay", "getUTCDay", "getHours", "getUTCHours", "getMinutes", "getUTCMinutes", "getSeconds", "getUTCSeconds", "getMilliseconds", "getUTCMilliseconds", "getTimezoneOffset", "getYear", "setTime", "setMilliseconds", "setUTCMilliseconds", "setSeconds", "setUTCSeconds", "setMinutes", "setUTCMinutes", "setHours", "setUTCHours", "setDate", "setUTCDate", "setMonth", "setUTCMonth", "setFullYear", "setUTCFullYear", "setYear", "toJSON", "toUTCString", "toGMTString", "toTemporalInstant"])
@@ -1773,6 +1775,7 @@ public extension ObjectGroup {
17731775
"getUint16" : [.integer] => .integer,
17741776
"getInt32" : [.integer] => .integer,
17751777
"getUint32" : [.integer] => .integer,
1778+
"getFloat16" : [.integer] => .float,
17761779
"getFloat32" : [.integer] => .float,
17771780
"getFloat64" : [.integer] => .float,
17781781
"getBigInt64": [.integer] => .bigint,
@@ -1782,6 +1785,7 @@ public extension ObjectGroup {
17821785
"setUint16" : [.integer, .integer] => .undefined,
17831786
"setInt32" : [.integer, .integer] => .undefined,
17841787
"setUint32" : [.integer, .integer] => .undefined,
1788+
"setFloat16" : [.integer, .float] => .undefined,
17851789
"setFloat32" : [.integer, .float] => .undefined,
17861790
"setFloat64" : [.integer, .float] => .undefined,
17871791
"setBigInt64": [.integer, .bigint] => .undefined,
@@ -1805,6 +1809,7 @@ public extension ObjectGroup {
18051809
"any" : [.jsPromise...] => .jsPromise,
18061810
"race" : [.jsPromise...] => .jsPromise,
18071811
"allSettled" : [.jsPromise...] => .jsPromise,
1812+
"try" : [.function(), .jsAnything...] => .jsPromise,
18081813
]
18091814
)
18101815

@@ -1922,9 +1927,10 @@ public extension ObjectGroup {
19221927
"prototype" : .jsArray,
19231928
],
19241929
methods: [
1925-
"from" : [.jsAnything, .opt(.function()), .opt(.object())] => .jsArray,
1926-
"isArray" : [.jsAnything] => .boolean,
1927-
"of" : [.jsAnything...] => .jsArray,
1930+
"from" : [.jsAnything, .opt(.function()), .opt(.object())] => .jsArray,
1931+
"fromAsync" : [.jsAnything, .opt(.function()), .opt(.object())] => .jsPromise,
1932+
"isArray" : [.jsAnything] => .boolean,
1933+
"of" : [.jsAnything...] => .jsArray,
19281934
]
19291935
)
19301936

@@ -2013,6 +2019,19 @@ public extension ObjectGroup {
20132019
]
20142020
)
20152021

2022+
/// Object group modelling the JavaScript RegExp constructor builtin
2023+
static let jsRegExpConstructor = ObjectGroup(
2024+
name: "RegExpConstructor",
2025+
constructorPath: "RegExp",
2026+
instanceType: .jsRegExpConstructor,
2027+
properties: [
2028+
"prototype" : .object()
2029+
],
2030+
methods: [
2031+
"escape" : [.string] => .jsString,
2032+
]
2033+
)
2034+
20162035
/// Object group modelling the JavaScript Boolean constructor builtin
20172036
static let jsBooleanConstructor = ObjectGroup(
20182037
name: "BooleanConstructor",
@@ -2058,41 +2077,43 @@ public extension ObjectGroup {
20582077
"PI" : .number
20592078
],
20602079
methods: [
2061-
"abs" : [.jsAnything] => .number,
2062-
"acos" : [.jsAnything] => .number,
2063-
"acosh" : [.jsAnything] => .number,
2064-
"asin" : [.jsAnything] => .number,
2065-
"asinh" : [.jsAnything] => .number,
2066-
"atan" : [.jsAnything] => .number,
2067-
"atanh" : [.jsAnything] => .number,
2068-
"atan2" : [.jsAnything, .jsAnything] => .number,
2069-
"cbrt" : [.jsAnything] => .number,
2070-
"ceil" : [.jsAnything] => .number,
2071-
"clz32" : [.jsAnything] => .number,
2072-
"cos" : [.jsAnything] => .number,
2073-
"cosh" : [.jsAnything] => .number,
2074-
"exp" : [.jsAnything] => .number,
2075-
"expm1" : [.jsAnything] => .number,
2076-
"floor" : [.jsAnything] => .number,
2077-
"fround" : [.jsAnything] => .number,
2078-
"hypot" : [.jsAnything...] => .number,
2079-
"imul" : [.jsAnything, .jsAnything] => .integer,
2080-
"log" : [.jsAnything] => .number,
2081-
"log1p" : [.jsAnything] => .number,
2082-
"log10" : [.jsAnything] => .number,
2083-
"log2" : [.jsAnything] => .number,
2084-
"max" : [.jsAnything...] => .jsAnything,
2085-
"min" : [.jsAnything...] => .jsAnything,
2086-
"pow" : [.jsAnything, .jsAnything] => .number,
2087-
"random" : [] => .number,
2088-
"round" : [.jsAnything] => .number,
2089-
"sign" : [.jsAnything] => .number,
2090-
"sin" : [.jsAnything] => .number,
2091-
"sinh" : [.jsAnything] => .number,
2092-
"sqrt" : [.jsAnything] => .number,
2093-
"tan" : [.jsAnything] => .number,
2094-
"tanh" : [.jsAnything] => .number,
2095-
"trunc" : [.jsAnything] => .number,
2080+
"abs" : [.jsAnything] => .number,
2081+
"acos" : [.jsAnything] => .number,
2082+
"acosh" : [.jsAnything] => .number,
2083+
"asin" : [.jsAnything] => .number,
2084+
"asinh" : [.jsAnything] => .number,
2085+
"atan" : [.jsAnything] => .number,
2086+
"atanh" : [.jsAnything] => .number,
2087+
"atan2" : [.jsAnything, .jsAnything] => .number,
2088+
"cbrt" : [.jsAnything] => .number,
2089+
"ceil" : [.jsAnything] => .number,
2090+
"clz32" : [.jsAnything] => .number,
2091+
"cos" : [.jsAnything] => .number,
2092+
"cosh" : [.jsAnything] => .number,
2093+
"exp" : [.jsAnything] => .number,
2094+
"expm1" : [.jsAnything] => .number,
2095+
"floor" : [.jsAnything] => .number,
2096+
"fround" : [.jsAnything] => .number,
2097+
"f16round" : [.jsAnything] => .number,
2098+
"hypot" : [.jsAnything...] => .number,
2099+
"imul" : [.jsAnything, .jsAnything] => .integer,
2100+
"log" : [.jsAnything] => .number,
2101+
"log1p" : [.jsAnything] => .number,
2102+
"log10" : [.jsAnything] => .number,
2103+
"log2" : [.jsAnything] => .number,
2104+
"max" : [.jsAnything...] => .jsAnything,
2105+
"min" : [.jsAnything...] => .jsAnything,
2106+
"pow" : [.jsAnything, .jsAnything] => .number,
2107+
"random" : [] => .number,
2108+
"round" : [.jsAnything] => .number,
2109+
"sign" : [.jsAnything] => .number,
2110+
"sin" : [.jsAnything] => .number,
2111+
"sinh" : [.jsAnything] => .number,
2112+
"sqrt" : [.jsAnything] => .number,
2113+
"sumPrecise" : [.jsAnything] => .number,
2114+
"tan" : [.jsAnything] => .number,
2115+
"tanh" : [.jsAnything] => .number,
2116+
"trunc" : [.jsAnything] => .number,
20962117
]
20972118
)
20982119

0 commit comments

Comments
 (0)