Implements robust break context identification and tests (#442)

Sources/Fuzzilli/Compiler/Compiler.swift

@@ -446,7 +446,6 @@ public class JavaScriptCompiler {
         case .breakStatement:
             // If we're in both .loop and .switch context, then the loop must be the most recent context 
             // (switch blocks don't propagate an outer .loop context) so we just need to check for .loop here
-            // TODO remove this comment once the Analyzer bug fixs has been merged. Until then the code in this switch case is buggy.
             if contextAnalyzer.context.contains(.loop){
                 emit(LoopBreak())
             } else if contextAnalyzer.context.contains(.switchBlock){

Sources/Fuzzilli/FuzzIL/Analyzer.swift

@@ -168,6 +168,15 @@ struct ContextAnalyzer: Analyzer {
 
                 newContext.formUnion(contextStack.secondToTop)
             }
+
+            // If we are in a loop, we don't want to propagate the switch context and vice versa. Otherwise we couldn't determine which break operation to emit.
+            // TODO Make this generic for similar logic cases as well. E.g. by using a instr.op.contextClosed list.
+            if (instr.op.contextOpened.contains(.switchBlock) || instr.op.contextOpened.contains(.switchCase)) {
+                newContext.remove(.loop)
+            } else if (instr.op.contextOpened.contains(.loop)) {
+                newContext.remove(.switchBlock) 
+                newContext.remove(.switchCase)
+            }
             contextStack.push(newContext)
         }
     }

Tests/FuzzilliTests/AnalyzerTest.swift

@@ -304,4 +304,49 @@ class AnalyzerTests: XCTestCase {
 
         let _  = b.finalize()
     }
+
+    // Tests if the context is correctly identified in nested loops and switches. 
+    // Needs to work to distinguish when to emit LoopBreak and SwitchBreak.
+    func testBreakContext() {
+        let fuzzer = makeMockFuzzer()
+        let b = fuzzer.makeBuilder()
+
+        let case1 = b.loadInt(1337)
+        let case2 = b.loadInt(9001)
+
+        // Test case 1: switch -> loop -> switch
+        b.buildSwitch(on: case1) { outer_switch in
+            XCTAssertEqual(b.context, .switchBlock)
+            outer_switch.addCase(case1) {
+                XCTAssertEqual(b.context, [.javascript, .switchCase])
+                b.buildWhileLoop({ b.loadBool(true) }) {        
+                    XCTAssertEqual(b.context, [.javascript, .loop])
+                    b.buildSwitch(on: case2) { inner_switch in
+                        XCTAssertEqual(b.context, .switchBlock)
+                        inner_switch.addCase(case2) {
+                            XCTAssertEqual(b.context, [.javascript, .switchCase])
+                        }
+                    }
+                } 
+            }
+        }
+        XCTAssertEqual(b.context, .javascript)
+
+        // Test case 2: loop -> switch -> loop
+        b.buildWhileLoop({ b.loadBool(true) }) {
+            XCTAssertEqual(b.context, [.javascript, .loop])
+            b.buildSwitch(on: case1) { swtch in
+                XCTAssertEqual(b.context, .switchBlock)
+                swtch.addCase(case1) {
+                    XCTAssertEqual(b.context, [.javascript, .switchCase])
+                    b.buildWhileLoop({ b.loadBool(true) }) {
+                        XCTAssertEqual(b.context, [.javascript, .loop])
+                    }
+                }
+            }
+        }
+        XCTAssertEqual(b.context, .javascript)
+
+        let _ = b.finalize()
+    }
 }