Closed Bug 343951 Opened 18 years ago Closed 3 years ago

[meta] New Script Node fuzzer

Categories

(Core :: Fuzzing, defect)

Product:
Core
Component:
Fuzzing
Platform:
PowerPC
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: jruderman, Unassigned)

References

(Depends on 1 open bug)

Details

(Keywords: meta, sec-other, Whiteboard: [sg:nse])

Attachments

(1 file, 2 obsolete files)

Some assertions and crashes this fuzzer hits
(deleted), text/plain
Details
This fuzzer does StirDOM-like things, and inserts script elements containing scripts that "recursively" do StirDOM-like things as they are inserted into the document. It found bug 343730.
Attached file New Script Node fuzzer 2.0 (obsolete) (deleted) —
Requires fuzz.js 2.0.x, which can be found in bug 339948.
Should I reduce some more of these now, or wait until bug 343730 is fixed?
Whiteboard: [sg:nse]
Putting the last attachment in the bug so the assertions will show up in "comment contains" searches. Bug 343730: ###!!! ASSERTION: Bound to wrong document: 'aDocument == GetCurrentDoc()', file /Users/admin/trunk/mozilla/content/base/src/nsGenericElement.cpp, line 1950 With intermediate testcases I made while reducing bug 343730: ###!!! ASSERTION: Already have a document. Unbind first!: '!GetCurrentDoc() && !IsInDoc()', file /Users/admin/trunk/mozilla/content/base/src/nsGenericDOMDataNode.cpp, line 616 ###!!! ASSERTION: Bound to wrong parent: 'aParent == GetParent()', file /Users/admin/trunk/mozilla/content/base/src/nsGenericElement.cpp, line 1951 ###!!! ASSERTION: aDocument must be current doc of aParent: '!aParent || (aParent->IsNodeOfType(eXUL) && aDocument == nsnull) || aDocument == aParent->GetCurrentDoc()', file /Users/admin/trunk/mozilla/content/base/src/nsGenericElement.cpp, line 1841 Crash [@ nsBindingManager::GetNestedInsertionPoint] With other seeds / documents: ###!!! ASSERTION: Already have an undisplayed context entry for aContent: '!GetUndisplayedContent(aContent)', file /Users/admin/trunk/mozilla/layout/base/nsFrameManager.cpp, line 570 ###!!! ASSERTION: node in map twice: 'Not Reached', file /Users/admin/trunk/mozilla/layout/base/nsFrameManager.cpp, line 1624 ###!!! ASSERTION: Found more undisplayed content data after removal: 'context == nsnull', file /Users/admin/trunk/mozilla/layout/base/nsFrameManager.cpp, line 627 ###!!! ASSERTION: out-of-bounds access in nsAttrAndChildArray: 'aPos < ChildCount()', file /Users/admin/trunk/mozilla/content/base/src/nsAttrAndChildArray.h, line 87 Crash [@ nsContentUtils::ComparePosition]
Attached file New Script Node fuzzer 3.0 (obsolete) (deleted) —
Attachment #228518 - Attachment is obsolete: true
The fix for bug 351633, "Make javascript: URI execution async" helped by fixing bug 344996. The upcoming fix for bug 343730, "Scripts should not fire synchronously in BindToTree", will also help.
Shouldn't have security bugs assigned to nobody. Jesse can own his test bugs
Assignee: nobody → jruderman
Comment on attachment 242975 [details] New Script Node fuzzer 3.0 New version in bug 339948.
Attachment #242975 - Attachment is obsolete: true
Depends on: 405182
Depends on: 423355
Depends on: 427691
Depends on: 466747
Depends on: 512815
Depends on: 580151
Depends on: 606430
Depends on: 754029
No longer blocks: fuzz
Component: Tracking → Platform Fuzzing Team

The bug assignee didn't login in Bugzilla in the last 7 months.
:decoder, could you have a look please?
For more information, please visit auto_nag documentation.

Assignee: jruderman → nobody
Flags: needinfo?(choller)
Summary: New Script Node fuzzer → [meta] New Script Node fuzzer
Status: NEW → RESOLVED
Closed: 3 years ago
Flags: needinfo?(choller)
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: