From 610e7ccddc8f1f0c4ee27e0c10bb7ca6914caf57 Mon Sep 17 00:00:00 2001 From: maorun1 Date: Thu, 20 Jun 2024 20:54:49 +0800 Subject: [PATCH 1/2] add CollectionsSet\CollectionsArray\CollectionsArrayBuffer\CollectionsTypedArray API --- Sources/FuzzilliCli/Profiles/ArkProfile.swift | 175 +++++++++++++++++- 1 file changed, 168 insertions(+), 7 deletions(-) diff --git a/Sources/FuzzilliCli/Profiles/ArkProfile.swift b/Sources/FuzzilliCli/Profiles/ArkProfile.swift index 9e498b4..34e9983 100644 --- a/Sources/FuzzilliCli/Profiles/ArkProfile.swift +++ b/Sources/FuzzilliCli/Profiles/ArkProfile.swift @@ -42,13 +42,25 @@ fileprivate let ArkTSObjectInstanceGenerator = ValueGenerator("ArkTSObjectInstan } } -/// ArkTS Collections Generators +/// ArkTS collections Generators fileprivate let ArkTSCollectionsObjectInstanceGenerator = ValueGenerator("ArkTSCollectionsObjectInstanceGenerator") { b, n in - let builtin = chooseUniform(from: ["SharedMap"]) + let builtin = chooseUniform(from: ["SharedMap", "SharedSet", "SharedArray", "SendableArrayBuffer"]) let constructor = b.loadBuiltin(builtin) b.construct(constructor) } +fileprivate let ArkTsCollectionsTypedArrayValueGenerator = ValueGenerator("ArkTsCollectionsTypedArrayValueGenerator") { b, n in + for _ in 0.. ILType { + return .iterable + .object(ofGroup: variant, withProperties: ["buffer", "byteOffset", "byteLength", "length","BYTES_PER_ELEMENT"], withMethods: ["from", "copyWithin", "some", "every", "fill", "filter", "find", "findIndex", "forEach", "indexOf", "join", "map", "reduce", "reverse", "set", "slice", "sort", "subarray", "at", "includes", "entries", "keys", "values"]) +} /// Type of the ArkTS Stack constructor builtin. fileprivate let arkTSStackConstructor = ILType.constructor([] => arkTSStack) @@ -88,7 +110,17 @@ fileprivate let arkTSTreeSetConstructor = ILType.constructor([.opt(.function([.a /// Type of the ArkTs CollectionsMap constructor builtin. fileprivate let collectionsMapConstructor = ILType.constructor([.object()] => collectionsMap) - +/// Type of the ArkTs CollectionsSet constructor builtin. +fileprivate let collectionsSetConstructor = ILType.constructor([.object()] => collectionsSet) +/// Type of the ArkTs Array constructor builtin. +fileprivate let collectionsArrayConstructor = ILType.constructor([.anything...] => collectionsArray) +/// Type of the ArkTs collectionsArrayBuffer constructor builtin. +fileprivate let collectionsArrayBufferConstructor = ILType.constructor([.number] => collectionsArrayBuffer) +/// Type of a JavaScript TypedArray constructor builtin. +fileprivate func collectionsTypedArrayConstructor(_ variant: String) -> ILType { + // TODO Also allow SendableArrayBuffers for first argument + return .constructor([.opt(.object(ofGroup: "SendableArrayBuffer")), .opt(.integer), .opt(.integer)] => collectionsTypedArray(variant)) +} /// ObjectGroup modelling ArkTS Stack objects fileprivate let arkTSStacks = ObjectGroup( @@ -151,6 +183,114 @@ fileprivate let collectionsMaps = ObjectGroup( ] ) +///ObjectGroup modelling ArkTs Set objects +fileprivate let collectionsSets = ObjectGroup( + name: "SharedSet", + instanceType: collectionsSet, + properties: [ + "size" : .number + ], + methods: [ + "entries" : [] => .object(), + "keys" : [] => .object(), + "values" : [] => .object(), + "clear" : [] => .undefined, + "delete" : [.anything] => .boolean, + "forEach" : [.function([.opt(.anything), .opt(.anything), .opt(collectionsSet)] => .undefined), .opt(.object())] => .undefined, + "has" : [.anything] => .boolean, + "add" : [.anything] => collectionsSet, + ] +) + + +/// Object group modelling ArkTs arrays +fileprivate let collectionsArrays = ObjectGroup( + name: "SharedArray", + instanceType: collectionsArray, + properties: [ + "length" : .number, + ], + methods: [ + "create" : [.number, .anything] => collectionsArray, + "from" : [.anything] => collectionsArray, + "pop" : [] => .anything, + "push" : [.anything...] => .number, + "join" : [.opt(.string)] => .jsString, + "shift" : [] => .anything, + "unshift" : [.anything...] => .number, + "slice" : [.opt(.number), .opt(.number)] => collectionsArray, + "sort" : [.opt(.function())] => collectionsArray, + "indexOf" : [.anything, .opt(.number)] => .number, + "forEach" : [.function([.opt(.anything), .opt(.number), .opt(collectionsArray)] => .undefined), .opt(.object())] => .undefined, + "map" : [.function()] => collectionsArray, + "filter" : [.function()] => collectionsArray, + "reduce" : [.function(), .opt(.anything)] => .anything, + "at" : [.number] => .anything, + "entries" : [] => .object(), + "keys" : [] => .object(), + "values" : [] => .object(), + "find" : [.function()] => .anything, + "includes" : [.anything, .opt(.number)] => .boolean, + "findIndex" : [.function()] => .number, + "fill" : [.anything, .opt(.number), .opt(.number)] => collectionsArray, + "shrinkTo" : [.number] => .undefined, + "extendTo" : [.number, .anything ] => .undefined, + "concat" : [.anything...] => collectionsArray, + ] +) + +/// ObjectGroup modelling ArkTs SendableArrayBuffer objects +fileprivate let collectionsArrayBuffers = ObjectGroup( + name: "SendableArrayBuffer", + instanceType: collectionsArrayBuffer, + properties: [ + "byteLength" : .number, + ], + methods: [ + "slice" : [.number, .opt(.number)] => collectionsArrayBuffer, + ] +) + +/// ObjectGroup modelling ArkTs SharedTypedArray objects +fileprivate func collectionsTypedArrays(_ variant: String) -> ObjectGroup { + return ObjectGroup( + name: variant, + instanceType: collectionsTypedArray(variant), + properties: [ + "buffer" : .jsArrayBuffer, + "byteLength" : .number, + "byteOffset" : .number, + "length" : .number, + "BYTES_PER_ELEMENT" : .number, + ], + methods: [ + "from" : [.anything, .opt(.anything)] => collectionsTypedArray(variant), + "copyWithin" : [.number, .number, .opt(.number)] => collectionsTypedArray(variant), + "some" : [.function()] => .boolean, + "every" : [.function()] => .boolean, + "fill" : [.opt(.number), .opt(.number)] => collectionsTypedArray(variant), + "filter" : [.function()] => collectionsTypedArray(variant), + "find" : [.function()] => .anything, + "findIndex" : [.function()] => .integer, + "forEach" : [.function([.opt(.number), .opt(collectionsTypedArray(variant))] => .undefined)] => .undefined, + "indexOf" : [.number, .opt(.number)] => .number, + "join" : [.string] => .jsString, + "map" : [.function()] => collectionsTypedArray(variant), + "reduce" : [.function(), .opt(.anything)] => .anything, + "reverse" : [] => collectionsTypedArray(variant), + "set" : [.object(), .opt(.number)] => .undefined, + "slice" : [.opt(.number), .opt(.number)] => collectionsTypedArray(variant), + "sort" : [.function()] => collectionsTypedArray(variant), + "subarray" : [.opt(.number), .opt(.number)] => collectionsTypedArray(variant), + "at" : [.number] => .anything, + "includes" : [.number, .opt(.number)] => .boolean, + "entries" : [] => .object(), + "keys" : [] => .object(), + "values" : [] => .object(), + ] + ) +} + /// ObjectGroup modelling ArkTS HashSet objects fileprivate let arkTSHashSets = ObjectGroup( name: "HashSet", @@ -359,10 +499,11 @@ let arkProfile = Profile( crashTests: ["fuzzilli('FUZZILLI_CRASH', 0)", "fuzzilli('FUZZILLI_CRASH', 1)"], additionalCodeGenerators: [ - (PrintGenerator, 40), - (RunNearStackLimitGenerator, 5), - (ArkTSObjectInstanceGenerator, 20), - (ArkTSCollectionsObjectInstanceGenerator, 20), + (PrintGenerator, 40), + (RunNearStackLimitGenerator, 5), + (ArkTSObjectInstanceGenerator, 20), + (ArkTSCollectionsObjectInstanceGenerator, 20), + (ArkTsCollectionsTypedArrayValueGenerator, 10), ], additionalProgramTemplates: WeightedList([]), @@ -385,6 +526,16 @@ let arkProfile = Profile( "Stack" : arkTSStackConstructor, "HashMap" : arkTSHashMapConstructor, "SharedMap" : collectionsMapConstructor, + "SharedSet" : collectionsSetConstructor, + "SharedArray" : collectionsArray, + "SendableArrayBuffer" : collectionsArrayBuffer, + "SharedInt8Array" : collectionsTypedArrayConstructor("SharedInt8Array"), + "SharedUint8Array" : collectionsTypedArrayConstructor("SharedUint8Array"), + "SharedInt16Array" : collectionsTypedArrayConstructor("SharedInt16Array"), + "SharedUint16Array" : collectionsTypedArrayConstructor("SharedUint16Array"), + "SharedInt32Array" : collectionsTypedArrayConstructor("SharedInt32Array"), + "SharedUint32Array" : collectionsTypedArrayConstructor("SharedUint32Array"), + "SharedUint8ClampedArray" : collectionsTypedArrayConstructor("SharedUint8ClampedArray"), "HashSet" : arkTSHashSetConstructor, "LinkedList" : arkTSLinkedListConstructor, "List" : arkTSListConstructor, @@ -397,6 +548,16 @@ let arkProfile = Profile( arkTSStacks, arkTSHashMaps, collectionsMaps, + collectionsSets, + collectionsArrays, + collectionsArrayBuffers, + collectionsTypedArrays("SharedInt8Array"), + collectionsTypedArrays("SharedInt16Array"), + collectionsTypedArrays("SharedInt32Array"), + collectionsTypedArrays("SharedUint8Array"), + collectionsTypedArrays("SharedUint16Array"), + collectionsTypedArrays("SharedUint32Array"), + collectionsTypedArrays("SharedUint8ClampedArray"), arkTSHashSets, arkTSLinkedLists, arkTSLists, -- Gitee From ca0fbd0c56375f1907a7f63c370ea38d1e1134ba Mon Sep 17 00:00:00 2001 From: maorun1 Date: Fri, 21 Jun 2024 02:24:07 +0000 Subject: [PATCH 2/2] update Sources/FuzzilliCli/Profiles/ArkProfile.swift. Signed-off-by: maorun1 --- Sources/FuzzilliCli/Profiles/ArkProfile.swift | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Sources/FuzzilliCli/Profiles/ArkProfile.swift b/Sources/FuzzilliCli/Profiles/ArkProfile.swift index 34e9983..c838fde 100644 --- a/Sources/FuzzilliCli/Profiles/ArkProfile.swift +++ b/Sources/FuzzilliCli/Profiles/ArkProfile.swift @@ -257,7 +257,7 @@ fileprivate func collectionsTypedArrays(_ variant: String) -> ObjectGroup { name: variant, instanceType: collectionsTypedArray(variant), properties: [ - "buffer" : .jsArrayBuffer, + "buffer" : collectionsArrayBuffer, "byteLength" : .number, "byteOffset" : .number, "length" : .number, @@ -268,7 +268,7 @@ fileprivate func collectionsTypedArrays(_ variant: String) -> ObjectGroup { "copyWithin" : [.number, .number, .opt(.number)] => collectionsTypedArray(variant), "some" : [.function()] => .boolean, "every" : [.function()] => .boolean, - "fill" : [.opt(.number), .opt(.number)] => collectionsTypedArray(variant), + "fill" : [.number, .opt(.number), .opt(.number)] => collectionsTypedArray(variant), "filter" : [.function()] => collectionsTypedArray(variant), "find" : [.function()] => .anything, "findIndex" : [.function()] => .integer, @@ -526,7 +526,7 @@ let arkProfile = Profile( "Stack" : arkTSStackConstructor, "HashMap" : arkTSHashMapConstructor, "SharedMap" : collectionsMapConstructor, - "SharedSet" : collectionsSetConstructor, + "SharedSet" : collectionsSetConstructor, "SharedArray" : collectionsArray, "SendableArrayBuffer" : collectionsArrayBuffer, "SharedInt8Array" : collectionsTypedArrayConstructor("SharedInt8Array"), @@ -548,7 +548,7 @@ let arkProfile = Profile( arkTSStacks, arkTSHashMaps, collectionsMaps, - collectionsSets, + collectionsSets, collectionsArrays, collectionsArrayBuffers, collectionsTypedArrays("SharedInt8Array"), -- Gitee