To build JavaScriptCore (jsc) for fuzzing:
- Clone the WebKit mirror from https://github.com/WebKit/webkit
- Apply Patches/*. The patches should apply cleanly to the git revision specified in ./REVISION
(Note: If you clone WebKit from
git.webkit.org, the commit hash will differ) - Run the fuzzbuild.sh script in the webkit root directory
- WebKitBuild/Fuzzilli/bin/jsc will be the JavaScript shell for the fuzzer