320996 - (xangle) mangle xul tags

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Bernd]

the mangleme script targets html, I thought that this should work also with xul. The attached "kiddy" stuff crashes at the first url that it creates.

Comment 1

[Bernd]

Attachment: sources.zip

Comment 2

[Bernd]

Attachment: first testcase (crashes onload for me at least)

Comment 3

[Bernd]

the testcase crashes for me locally

Comment 4

[Bernd]

Martijn, I just want to make sure that you see the new toy.

Comment 5

[Jesse Ruderman]

I reduced the testcase in comment 2 and filed bug 321016 based on it.  I'm turning this into a metabug to match the bugs for other fuzz-testing tools.

Comment 6

[Jesse Ruderman]

Neil, interested in trying to fix some of these?

Comment 7

[Jesse Ruderman]

Attachment: Diff showing changes I made to the C++ program

I added the ability to output nested tags, removed some bogus tags, and commented out <listboxbody> because it's known to crash.

I ran 500 files generated by this program through Firefox 1.5 and none of them made it crash.

Comment 8

[Jesse Ruderman]

Attachment: New version of xangle

Comment 9

[Bernd]

Attachment: make it crash again

the diff is relative to attachment 206455 [details] and crashes tree times within the first 500 testfiles.

Comment 10

[Jesse Ruderman]

The new version (comment 9) generates files that are both smaller and flatter, so it would surprise me if it were more effective at finding bugs.

I don't get any crashes in the first 500 files (on Mac, using g++ 3.3's rand impl).  I tried with Firefox 1.5, today's trunk nightly, and my trunk debug build.  I also don't get any new assertions or warnings in the debug build.

Can you attach and/or reduce the files that crash for you?

Comment 11

[Bernd]

One crash got fixed by updating the browser, testcase 279 and 402 crash both at bug 321224.

Btw http://events.ccc.de/congress/2005/fahrplan/events/537.en.html and the links there are interesting stuff.

Comment 12

[Bernd]

Attachment: next. rev.

no new crashes, but new asserts, hang and window folding

Comment 13

[Bernd]

Attachment: rev 2006/01/08

some more style args, makes it crash again

Comment 14

[Jesse Ruderman]

I made two changes to my local copy:

* Added "\n" to the dump, so I can "grep | sort | uniq -c" for assertion lines.

* Removed the space before both instances of "<script>var v =", which interfered with Lithium's indentation-based tree strucure guessing.

Comment 15

[Jesse Ruderman]

With the second patch to bug 140218, Firefox gets through 500 Xangle-generated pages without a crash or hang.  It stops drawing pretty quickly (bug 322731).  It hits a lot of assertions, but I think we already have bugs on all of them (the ones I checked were in this bug's dependencies list).