Closed Bug 321107 (ajax-demolisher) Opened 15 years ago Closed 3 years ago

Ajax demolisher for crashing Mozilla

Categories

(Core :: Layout, defect)

x86
Windows XP
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: martijn.martijn, Unassigned)

References

(Blocks 1 open bug, )

Details

(Keywords: meta, sec-other, Whiteboard: [sg:nse] meta)

Attachments

(8 files)

8.85 KB, text/html
Details
v3
7.58 KB, application/x-zip-compressed
Details
v4
11.71 KB, application/x-unknown
Details
v5
19.00 KB, application/zip
Details
v6
34.39 KB, application/zip
Details
v7
155.00 KB, application/octet-stream
Details
v7
59.22 KB, application/zip
Details
v8
88.51 KB, application/zip
Details
You need to use this tool locally to get it to work.
You need to make a 'mozdata.htm' file in C://
Then execute filewrite.xul
Every 6s or so it refreshes the bottom frame with a new mangled html file. 
When Mozilla crashes, you are left with a html file that crashes (well, most of the time).
At the end of that 'mozdata.htm' file, I add this text (sort of), to trigger the crash:
</textarea></iframe></object></script>
<script>
function addstyles(){
var x=document.createElement('style');
x.innerHTML='\
*:first-child::first-line { text-transform: uppercase;
background-color:green; font-size:110%;}\
*:first-child::after { content:"anonymous text";
float:right;border:3px solid black;text-transform: uppercase;}\
*:first-child::before { content:"before text"; float:right;border:3px
solid black;font-size: 10px;}\
';
document.documentElement.appendChild(x);
}

function removestyles(i){


var x=document.getElementsByTagName('*');

if (x[i])
 {
x[i].removeAttribute('style');
}

 i++;
setTimeout(removestyles,50,i);
}
setTimeout(addstyles,200);
setTimeout(removestyles,500,0);
</script>

I filed it as security-sensitive, if it's not security-sensitive, then please
make the bug public.
Bugs not fixed yet, that were discovered with this tool:
Bug 315850, bug 315918, bug 316026, bug 317179, bug 317275, bug 317302, bug 317724, bug 317854, bug 317876, bug 318592.
Depends on: 321894
Depends on: 321896
Whiteboard: [sg:nse] meta
Depends on: 322348
Attached file manglehtmlv2
Improvements:
1 single html file, no need to create mozdata.html manually anymore, not dependent on textarea.value anymore.
Depends on: 322652
Depends on: 322657
Depends on: 322678
Depends on: 322685
Depends on: 322688
Depends on: 322689
Depends on: 322704
Depends on: 322812
Depends on: 322820
Attached file v3
Some more improvements, now you can create html, xul, svg files.
Depends on: 326015
Depends on: 328527, 329692, 329762, 329768
Depends on: 309467, 309777
Depends on: 329900
Depends on: 330981
Attached file v4
Some more options (midas ability, adding random xbl, with/without extra text, templates).
The code is becoming real messy, now.
I also have an official name for this thing: Ajax crusher (I really wanted to have something with Ajax in it).
Er, I meant: Ajax demolisher!
Turning off/on elements/style rules still needs to happen manually in the crasher.htm file.
Summary: Manglehtml tool for crashing Mozilla → Ajax demolisher for crashing Mozilla
Depends on: 343206
Attached file v5
Version 5.
Now also able to change various other styles and some other stuff fixed.
Attached file v6
- templates: you can relative easy add custom scripts (in the templates/ directory) which can do any stuff (changing styles, stirdom, etc) on the document
- Added a bunch of other styles
- I removed the size check for xml docs, so look out for that, if you use this.
- Added a test button, to test only
- Added some foreignobject stuff for trunk, to be able to rotate, zoom and so.
Alias: ajax-demolisher
Attached file v7
With more templates (including ispiked's print preview one), also with all kinds of (unminimised and minimised) crashers that are now wfm.
To use this, open ajaxdemolisher.htm.
To test the worksformecrashes, just push the 'just test' button.
Attached file v7
v7 without the worksorme crashers, but with the crashers that still crash nowadays on trunk.
(In reply to comment #8)
> To test the worksformecrashes, just push the 'just test' button.

Er, I meant the 'wfm_test.htm' button.

Attached file v8
version 8, not sure, what changed compared to version 7.
I believe now the ability to add print preview was added.
Group: core-security
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → WORKSFORME
Status: RESOLVED → REOPENED
Resolution: WORKSFORME → ---
Status: REOPENED → RESOLVED
Closed: 4 years ago3 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.