Add a dictionary for the execute and JIT fuzzers

sapi/fuzzer/README.md

@@ -70,7 +70,8 @@ For the execute, function-jit and tracing-jit fuzzers, a corpus may be generated
 
 ```sh
 sapi/cli/php sapi/fuzzer/generate_execute_corpus.php ./execute-corpus Zend/tests ext/opcache/tests/jit
-sapi/fuzzer/php-fuzzer-function-jit ./execute-corpus
+sapi/cli/php sapi/fuzzer/generate_execute_dict.php
+sapi/fuzzer/php-fuzz-function-jit -dict=$PWD/sapi/fuzzer/dict/execute ./execute-corpus
 ```
 
 For the mbstring fuzzer, a dictionary of encodings should be generated first:

sapi/fuzzer/generate_all.php

@@ -1,6 +1,7 @@
 <?php
 require __DIR__ . '/generate_unserialize_dict.php';
 require __DIR__ . '/generate_mbstring_dict.php';
+require __DIR__ . '/generate_execute_dict.php';
 require __DIR__ . '/generate_unserializehash_corpus.php';
 require __DIR__ . '/generate_parser_corpus.php';
 

sapi/fuzzer/generate_execute_dict.php

@@ -0,0 +1,12 @@
+<?php
+
+/* Internal functions and classes are looked up through hash tables, so the fuzzer cannot
+ * learn their names from comparisons. Combine them with the keywords of the parser dictionary. */
+$dict = file_get_contents(__DIR__ . "/dict/parser");
+foreach (get_defined_functions()['internal'] as $function) {
+    $dict .= "\"" . addcslashes($function, "\\\"") . "\"\n";
+}
+foreach (array_merge(get_declared_classes(), get_declared_interfaces()) as $class) {
+    $dict .= "\"" . addcslashes($class, "\\\"") . "\"\n";
+}
+file_put_contents(__DIR__ . "/dict/execute", $dict);