From d05ece789ba3f1abbde6f6b2a91fdb77599d03ad Mon Sep 17 00:00:00 2001
From: Yuma Kakei <yumasansansan@gmail.com>
Date: Mon, 26 Oct 2026 16:31:02 +0900
Subject: [PATCH] Add a dictionary for the execute and JIT fuzzers

Internal functions and classes are looked up through hash tables, so
the fuzzer cannot learn their names from comparisons. Generate a
dictionary of internal functions, classes and interfaces, combined with
the keywords of the parser dictionary. Also fix the fuzzer name in the
README.
---
 sapi/fuzzer/README.md                 |  3 ++-
 sapi/fuzzer/generate_all.php          |  1 +
 sapi/fuzzer/generate_execute_dict.php | 12 ++++++++++++
 3 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 sapi/fuzzer/generate_execute_dict.php

diff --git a/sapi/fuzzer/README.md b/sapi/fuzzer/README.md
index c9ce6ebab52b..af4313cffee5 100644
--- a/sapi/fuzzer/README.md
+++ b/sapi/fuzzer/README.md
@@ -70,7 +70,8 @@ For the execute, function-jit and tracing-jit fuzzers, a corpus may be generated
 
 ```sh
 sapi/cli/php sapi/fuzzer/generate_execute_corpus.php ./execute-corpus Zend/tests ext/opcache/tests/jit
-sapi/fuzzer/php-fuzzer-function-jit ./execute-corpus
+sapi/cli/php sapi/fuzzer/generate_execute_dict.php
+sapi/fuzzer/php-fuzz-function-jit -dict=$PWD/sapi/fuzzer/dict/execute ./execute-corpus
 ```
 
 For the mbstring fuzzer, a dictionary of encodings should be generated first:
diff --git a/sapi/fuzzer/generate_all.php b/sapi/fuzzer/generate_all.php
index 5794bdacc6ba..08f8b4272f6a 100644
--- a/sapi/fuzzer/generate_all.php
+++ b/sapi/fuzzer/generate_all.php
@@ -1,6 +1,7 @@
 <?php
 require __DIR__ . '/generate_unserialize_dict.php';
 require __DIR__ . '/generate_mbstring_dict.php';
+require __DIR__ . '/generate_execute_dict.php';
 require __DIR__ . '/generate_unserializehash_corpus.php';
 require __DIR__ . '/generate_parser_corpus.php';
 
diff --git a/sapi/fuzzer/generate_execute_dict.php b/sapi/fuzzer/generate_execute_dict.php
new file mode 100644
index 000000000000..170ed165f09c
--- /dev/null
+++ b/sapi/fuzzer/generate_execute_dict.php
@@ -0,0 +1,12 @@
+<?php
+
+/* Internal functions and classes are looked up through hash tables, so the fuzzer cannot
+ * learn their names from comparisons. Combine them with the keywords of the parser dictionary. */
+$dict = file_get_contents(__DIR__ . "/dict/parser");
+foreach (get_defined_functions()['internal'] as $function) {
+    $dict .= "\"" . addcslashes($function, "\\\"") . "\"\n";
+}
+foreach (array_merge(get_declared_classes(), get_declared_interfaces()) as $class) {
+    $dict .= "\"" . addcslashes($class, "\\\"") . "\"\n";
+}
+file_put_contents(__DIR__ . "/dict/execute", $dict);