diff --git a/Sources/FuzzilliCli/Profiles/ArkProfile.swift b/Sources/FuzzilliCli/Profiles/ArkProfile.swift index dd73609a3ede9d778ca68cbd83cd3eddd89461af..1efca2721517a214ce2de24c6daf04aa4ec5b647 100644 --- a/Sources/FuzzilliCli/Profiles/ArkProfile.swift +++ b/Sources/FuzzilliCli/Profiles/ArkProfile.swift @@ -25,6 +25,12 @@ fileprivate let RunNearStackLimitGenerator = CodeGenerator("RunNearStackLimitGen b.callFunction(fun, withArgs: [f]) } +//testTryCatchForFunc +fileprivate let TestTryCatchForFuncGenerator = CodeGenerator("TestTryCatchForFuncGenerator", inputs: .required(.function())) { b, f in + let fun = b.loadBuiltin("testTryCatchForFunc") + b.callFunction(fun, withArgs: [f]) +} + /// ArkTS Generators fileprivate let ArkTSObjectInstanceGenerator = ValueGenerator("ArkTSObjectInstanceGenerator") { b, n in let builtin = chooseUniform(from: ["Stack", "HashMap", "HashSet", "LinkedList", "List", "ArrayList", "TreeMap", "TreeSet", "LightWeightMap", "LightWeightSet" , "Deque", "Queue", "PlainArray"]) @@ -689,6 +695,7 @@ let arkProfile = Profile( function sgc() { for(let i=0; i<0x10000; i+=1) {new String();} } function runNearStackLimit(f) { function t() { try { t(); } catch(e) { f(); } }; try { t(); } catch(e) {} } + function testTryCatchForFunc(f){try { f(); } catch(e) {print("123");}} function arkPrint(d) { print(JSON.stringify(d)); } """, @@ -700,12 +707,13 @@ let arkProfile = Profile( crashTests: ["fuzzilli('FUZZILLI_CRASH', 0)", "fuzzilli('FUZZILLI_CRASH', 1)"], additionalCodeGenerators: [ - (PrintGenerator, 40), + (PrintGenerator, 30), (RunNearStackLimitGenerator, 5), - (ArkTSObjectInstanceGenerator, 20), - (ArkTSCollectionsObjectInstanceGenerator, 20), + (ArkTSObjectInstanceGenerator, 5), + (ArkTSCollectionsObjectInstanceGenerator, 15), (ArkTsCollectionsTypedArrayValueGenerator, 10), (ArkTsUtilsCodeGenerator, 5), + (TestTryCatchForFuncGenerator, 30), ], additionalProgramTemplates: WeightedList([]), diff --git a/trycatchtests/1.fzil b/trycatchtests/1.fzil new file mode 100644 index 0000000000000000000000000000000000000000..0ddba722504a7a77d88bab2d809ad9d85b5d579a Binary files /dev/null and b/trycatchtests/1.fzil differ diff --git a/trycatchtests/1.js b/trycatchtests/1.js new file mode 100644 index 0000000000000000000000000000000000000000..fece96178a10b5cb493fc2718300df3fc52d271d --- /dev/null +++ b/trycatchtests/1.js @@ -0,0 +1,28 @@ + +let o1 = {}; +for (let i = 0 ; i < 1; i++) { + try { + continue; + } catch(e19) { + o1 = [0] + } finally { + try { + o1[Math] + } catch (e) { + } + } +} + +let v = [] +for (const vv in v) { + try { + continue; + } catch(e19) { + o1 = [0] + } finally { + try { + o1[Math] + } catch (e) { + } + } +} diff --git a/trycatchtests/1test.fzil b/trycatchtests/1test.fzil new file mode 100644 index 0000000000000000000000000000000000000000..b48dd014269764dd2a6bed107b81010d182619dd Binary files /dev/null and b/trycatchtests/1test.fzil differ diff --git a/trycatchtests/1test.js b/trycatchtests/1test.js new file mode 100644 index 0000000000000000000000000000000000000000..7152b0796b63c45d7a53e469cc5647b6810a5f51 --- /dev/null +++ b/trycatchtests/1test.js @@ -0,0 +1,21 @@ +new Uint8Array(10); +new Uint8ClampedArray(128); +const v11 = new Int32Array(239); +const v14 = new Uint8Array(3695); +for (const v15 in v14) { + const v17 = [-514941.5156203632, 6.197615578418986, 892.1739646878298, 556.5417222356593, -1.0, NaN, -3.0, -1e-15]; + let v18 = 0; + try { + continue; + } catch (e19) { + //[...e19] = v17; + } finally { + try { + v11.reduceRight(-1000000000000.0, v17); + } catch (e) {} + } + while (Math.log2(11737), (-1068118312) ** v15, -1068118312 >> v15, v18 < 3) { + v17[Symbol.toPrimitive] = -1167271718; + v18++; + } +} \ No newline at end of file diff --git a/trycatchtests/1test2.js b/trycatchtests/1test2.js new file mode 100644 index 0000000000000000000000000000000000000000..c4196a38a04a209c30229722e6c9ecf963eb872d --- /dev/null +++ b/trycatchtests/1test2.js @@ -0,0 +1,29 @@ +let o1 = {} +for (let i = 0 ; i < 1; i++) { + const v1=[0] + try { + continue; + } catch(e19) { + [...o1] = v1 + } finally { + try { + o1[Math] + } catch (e) { + } + } +} + +let v = [] +for (const vv in v) { + const v2=[0] + try { + continue; + } catch(e19) { + [...o1] = v2 + } finally { + try { + o1[Math] + } catch (e) { + } + } +} diff --git a/trycatchtests/2.fzil b/trycatchtests/2.fzil new file mode 100644 index 0000000000000000000000000000000000000000..347c8b72b650d8171ff036f9badcf6c4c254aebb Binary files /dev/null and b/trycatchtests/2.fzil differ diff --git a/trycatchtests/2.js b/trycatchtests/2.js new file mode 100644 index 0000000000000000000000000000000000000000..22896a6997139d7253e0474ba3d7cab85b8d15ca --- /dev/null +++ b/trycatchtests/2.js @@ -0,0 +1,19 @@ +let a = 1 + +try { + for (let i = 0; i < 1; i++) { + } +} catch(e) { +} +a = 2 + + +function Test() { + for (let v1 = 0; v1 < 5; v1++) { + } + try { ("bigint").localeCompare(); } catch (e) {} + for (let i = 0; i < 5; i++) { + } +} + +Test() \ No newline at end of file diff --git a/trycatchtests/3.fzil b/trycatchtests/3.fzil new file mode 100644 index 0000000000000000000000000000000000000000..aebbcd8d6c16bece03ecb2763345f10b78005b36 Binary files /dev/null and b/trycatchtests/3.fzil differ diff --git a/trycatchtests/3.js b/trycatchtests/3.js new file mode 100644 index 0000000000000000000000000000000000000000..d2a35eb1d5392b165fb967ef0189835f54b3a6e2 --- /dev/null +++ b/trycatchtests/3.js @@ -0,0 +1,17 @@ +const v16 =[1,2,3,4]; +try { + v16.indexOf(-1); +} catch (e) { +} + +const v3 = this?.constructor; +try { + new v45(a1, 2) +} catch (e) {} + +try { + const v1 = Uint8Array(); + try { v1.set(v1)} catch (e) {} +} catch (e3) { + +} \ No newline at end of file diff --git a/trycatchtests/4.fzil b/trycatchtests/4.fzil new file mode 100644 index 0000000000000000000000000000000000000000..0a98b2d225104dc368153edb614a2d7e41c9752d Binary files /dev/null and b/trycatchtests/4.fzil differ diff --git a/trycatchtests/4.js b/trycatchtests/4.js new file mode 100644 index 0000000000000000000000000000000000000000..57146f4bfcdc3cd2ead145766cf6e32484916f0c --- /dev/null +++ b/trycatchtests/4.js @@ -0,0 +1,12 @@ +class C0 {} + +class C1 extends C0 { + static d; + constructor(a3, a4, a5, a6) { + try { + this.d = 0; + } catch(e7) {} + } +} +const v8 = new C1(C0, C1, C0,C0) +new C1(C0, v8, v8, C0) \ No newline at end of file diff --git a/trycatchtests/5.fzil b/trycatchtests/5.fzil new file mode 100644 index 0000000000000000000000000000000000000000..fe7defc89f1e6a4d1388c36717a1aac6842dce08 Binary files /dev/null and b/trycatchtests/5.fzil differ diff --git a/trycatchtests/5.js b/trycatchtests/5.js new file mode 100644 index 0000000000000000000000000000000000000000..c4bb4f62878059bb8f74480472c17136cb0e3301 --- /dev/null +++ b/trycatchtests/5.js @@ -0,0 +1,13 @@ +function Test() { + try { + let data = JSON.parse('{"name": "John"}'); + if (data.name) { + try { + data.name.toUpperCase() + } catch (e17) { + } + } + } catch (e17) { + } +} +Test() \ No newline at end of file diff --git a/trycatchtests/6.fzil b/trycatchtests/6.fzil new file mode 100644 index 0000000000000000000000000000000000000000..7f4becca52bc4ae28b9f32340ba05ed63adbc2ed Binary files /dev/null and b/trycatchtests/6.fzil differ diff --git a/trycatchtests/6.js b/trycatchtests/6.js new file mode 100644 index 0000000000000000000000000000000000000000..deb9352f4eec493e981ba2da033d88292d2f41a7 --- /dev/null +++ b/trycatchtests/6.js @@ -0,0 +1,27 @@ +class C1 { + constructor(a3) { + const v8 = a3.proto; + try { + try { + v8(); + } catch (e) { + } + } catch(e17) { + } + } +} +new C1(1073741824); +let c = 0; +class C2 { + constructor(a3) { + const v8 = a3.proto; + try { + try { v8(); } catch (e) { + } + } catch(e17) { + } finally { + c = 2 + } + } +} +new C2(1073741824); \ No newline at end of file diff --git a/trycatchtests/7.js b/trycatchtests/7.js new file mode 100644 index 0000000000000000000000000000000000000000..f8b234aa6a4ba535aef6a889a5be0de0e69e3763 --- /dev/null +++ b/trycatchtests/7.js @@ -0,0 +1,47 @@ +let a = 0; + +try { + let n = 1 + switch (n) { + case 1: + a = 1; + break; + case 2: + a = 2; + break; + default: + a = 3 + } +} catch (e) { +} + +a= 4 + +try { + let n = 1 + switch (n) { + case 4: + case 1: + a = 1; + for (let i = 0; i < 10; i++) { + try{ + if (i < 5) { + continue; + } + } catch(e) { + } + } + a++ + case 2: + a = 2; + break; + case 3: + a = 4; + break; + default: + a = 3; + } +} catch (e) { +} + +a =5 \ No newline at end of file