1677857 - Implement fuzzPriv.MP() in FuzzingFunctions

Status: RESOLVED FIXED

(Core :: Fuzzing, enhancement)

Description

[Tyson Smith [:tsmith]]

The old implementation can be found here: https://github.com/MozillaSecurity/fuzzpriv/blob/legacy/content/fuzzPriv.js#L157

Comment 1

[Andrew McCreight [:mccr8]]

Basically, you'd add a new method to FuzzingFunctions.webidl

The implementation in C++ would just be:
nsCOMPtr<nsIObserverService> os = services::GetObserverService();
os->NotifyObservers(nullptr, "memory-pressure", u"heap-minimize");

Comment 2

[Andrew McCreight [:mccr8]]

It might be better to rename this to "memoryPressure" or something because mp is a bit opaque IMO.

Paul, do you have time to look at this? It is sort of a "good first bug" for WebIDL.

Comment 3

[Paul Bone [:pbone] (PTO until 14/8/2025)]

Yeah, agreed it'd be good to do a "good first bug" for WebIDL.

A problem with the observer notification is that it is asynchronous (AIUI). It might be nice if the caller could wait until the compaction finished, maybe it could make some fuzzing things more deterministic.

Comment 4

[Andrew McCreight [:mccr8]]

That's a good point. The observer notification itself is synchronous, but the part where it propagates to the child processes is indeed async.

Comment 5

[Andrew McCreight [:mccr8]]

Hmm but I guess this will be run from a content process, so that shouldn't be an issue.

Comment 6

[Paul Bone [:pbone] (PTO until 14/8/2025)]

I think the completion of the GC will be async also. I'll check this when I implement it.

Comment 7

[Andrew McCreight [:mccr8]]

One thing I forgot to mention is that FuzzingFunctions is only available in fuzzing builds. You probably don't want to have to rebuild Firefox just to test this. I think you can avoid that by editing dom/base/moz.build and dom/webidl/moz.build to edit away the if CONFIG["FUZZING"]: for FuzzingFunctions.{h,cpp,webidl}.

Then you'll have to set the fuzzing.enabled pref in Firefox, because the FuzzingFunctions WebIDL interface has the property Pref="fuzzing.enabled"

Comment 8

[Andrew McCreight [:mccr8]]

This page has some documentation on WebIDL: https://developer.mozilla.org/en-US/docs/Mozilla/WebIDL_bindings

Most of that won't be stuff that you will need for this, because you are just adding one function.

Comment 9

[Paul Bone [:pbone] (PTO until 14/8/2025)]

Attachment: Bug 1677857 - Add new GC related fuzzing functions r=tsmith

This change runs a non-incremental shrinking GC if the new parameter is set
to true.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/71d7e6400bae
Add new GC related fuzzing functions r=tsmith,mccr8

Comment 11

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/71d7e6400bae