343951 - [meta] New Script Node fuzzer

Status: RESOLVED FIXED

(Core :: Fuzzing, defect)

Description

[Jesse Ruderman]

This fuzzer does StirDOM-like things, and inserts script elements containing scripts that "recursively" do StirDOM-like things as they are inserted into the document.  It found bug 343730.

Comment 1

[Jesse Ruderman]

Attachment: New Script Node fuzzer 2.0

Requires fuzz.js 2.0.x, which can be found in bug 339948.

Comment 2

[Jesse Ruderman]

Attachment: Some assertions and crashes this fuzzer hits

Should I reduce some more of these now, or wait until bug 343730 is fixed?

Comment 3

[Jesse Ruderman]

Putting the last attachment in the bug so the assertions will show up in "comment contains" searches.


Bug 343730:


###!!! ASSERTION: Bound to wrong document: 'aDocument == GetCurrentDoc()', file /Users/admin/trunk/mozilla/content/base/src/nsGenericElement.cpp, line 1950



With intermediate testcases I made while reducing bug 343730:


###!!! ASSERTION: Already have a document.  Unbind first!: '!GetCurrentDoc() && !IsInDoc()', file /Users/admin/trunk/mozilla/content/base/src/nsGenericDOMDataNode.cpp, line 616

###!!! ASSERTION: Bound to wrong parent: 'aParent == GetParent()', file /Users/admin/trunk/mozilla/content/base/src/nsGenericElement.cpp, line 1951

###!!! ASSERTION: aDocument must be current doc of aParent: '!aParent || (aParent->IsNodeOfType(eXUL) && aDocument == nsnull) || aDocument == aParent->GetCurrentDoc()', file /Users/admin/trunk/mozilla/content/base/src/nsGenericElement.cpp, line 1841

Crash [@ nsBindingManager::GetNestedInsertionPoint]



With other seeds / documents:


###!!! ASSERTION: Already have an undisplayed context entry for aContent: '!GetUndisplayedContent(aContent)', file /Users/admin/trunk/mozilla/layout/base/nsFrameManager.cpp, line 570

###!!! ASSERTION: node in map twice: 'Not Reached', file /Users/admin/trunk/mozilla/layout/base/nsFrameManager.cpp, line 1624

###!!! ASSERTION: Found more undisplayed content data after removal: 'context == nsnull', file /Users/admin/trunk/mozilla/layout/base/nsFrameManager.cpp, line 627

###!!! ASSERTION: out-of-bounds access in nsAttrAndChildArray: 'aPos < ChildCount()', file /Users/admin/trunk/mozilla/content/base/src/nsAttrAndChildArray.h, line 87

Crash [@ nsContentUtils::ComparePosition]

Comment 4

[Jesse Ruderman]

Attachment: New Script Node fuzzer 3.0

Comment 5

[Jesse Ruderman]

The fix for bug 351633, "Make javascript: URI execution async" helped by fixing bug 344996.

The upcoming fix for bug 343730, "Scripts should not fire synchronously in BindToTree", will also help.

Comment 6

[Daniel Veditz [:dveditz]]

Shouldn't have security bugs assigned to nobody. Jesse can own his test bugs

Comment 7

[Jesse Ruderman]

Comment on attachment 242975 [details]
New Script Node fuzzer 3.0

New version in bug 339948.

Comment 8

[Jesse Ruderman]

https://github.com/MozillaSecurity/funfuzz/blob/master/dom/fuzzer/modules/script-nodes.js

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee didn't login in Bugzilla in the last 7 months.
:decoder, could you have a look please?
For more information, please visit auto_nag documentation.