github
/
boa
mirror of https://github.com/boa-dev/boa.git
1
0
Fork 0
Code Issues Releases Wiki Activity
Rust编写的JavaScript引擎，该项目是一个试验性质的项目。
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
2338 Commits
22 Branches
24 Tags
686 MiB
Tree: df7960bca1
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'df7960bca1'
${ noResults }
boa/fuzz/Cargo.toml

42 lines
799 B
Raw Normal View History Unescape

Parser Idempotency Fuzzer (#2400) This Pull Request offers a fuzzer which is capable of detecting faults in the parser and interner. It does so by ensuring that the parsed AST remains the same between a parsed source and the result of parsing the `to_interned_string` result of the first parsed source. It changes the following: - Adds a fuzzer for the parser and interner. Any issues I raise in association with this fuzzer will link back to this fuzzer. You may run the fuzzer using the following commands: ```bash $ cd boa_engine $ cargo +nightly fuzz run -s none parser-idempotency ``` Co-authored-by: Addison Crump <addison.crump@cispa.de>
2 years ago
[package]
name = "boa_fuzz"
version = "0.0.0"
publish = false
edition = "2021"
[package.metadata]
cargo-fuzz = true
[dependencies]
libfuzzer-sys = "0.4"
fuzzer: bubble up NoInstructionsRemain error instead of trying to handle as exception (#2566) Hi, the `vm-implied` fuzzer panics when executing this testcase: ```javascript try { new function() { while (this) {} }(); } catch { } ``` `internal error: entered unreachable code: The NoInstructionsRemain native error cannot be converted to an opaque type` Handling the `NoInstructionsRemain` error upfront instead of going through the VM exception handling logic seems to work.
2 years ago
boa_ast = { path = "../boa_ast", features = ["arbitrary"] }
Parser Idempotency Fuzzer (#2400) This Pull Request offers a fuzzer which is capable of detecting faults in the parser and interner. It does so by ensuring that the parsed AST remains the same between a parsed source and the result of parsing the `to_interned_string` result of the first parsed source. It changes the following: - Adds a fuzzer for the parser and interner. Any issues I raise in association with this fuzzer will link back to this fuzzer. You may run the fuzzer using the following commands: ```bash $ cd boa_engine $ cargo +nightly fuzz run -s none parser-idempotency ``` Co-authored-by: Addison Crump <addison.crump@cispa.de>
2 years ago
boa_engine = { path = "../boa_engine", features = ["fuzz"] }
fuzzer: bubble up NoInstructionsRemain error instead of trying to handle as exception (#2566) Hi, the `vm-implied` fuzzer panics when executing this testcase: ```javascript try { new function() { while (this) {} }(); } catch { } ``` `internal error: entered unreachable code: The NoInstructionsRemain native error cannot be converted to an opaque type` Handling the `NoInstructionsRemain` error upfront instead of going through the VM exception handling logic seems to work.
2 years ago
boa_interner = { path = "../boa_interner", features = ["arbitrary"] }
Parser Idempotency Fuzzer (#2400) This Pull Request offers a fuzzer which is capable of detecting faults in the parser and interner. It does so by ensuring that the parsed AST remains the same between a parsed source and the result of parsing the `to_interned_string` result of the first parsed source. It changes the following: - Adds a fuzzer for the parser and interner. Any issues I raise in association with this fuzzer will link back to this fuzzer. You may run the fuzzer using the following commands: ```bash $ cd boa_engine $ cargo +nightly fuzz run -s none parser-idempotency ``` Co-authored-by: Addison Crump <addison.crump@cispa.de>
2 years ago
boa_parser = { path = "../boa_parser" }
# Prevent this from interfering with workspaces
[workspace]
members = ["."]
[profile.release]
debug = 1
[[bin]]
name = "parser-idempotency"
path = "fuzz_targets/parser-idempotency.rs"
test = false
doc = false
VM Fuzzer (#2401) This Pull Request offers a basic VM fuzzer which relies on implied oracles (namely, "does it crash or timeout?"). It changes the following: - Adds an insns_remaining field to Context, denoting the number of instructions remaining to execute (only available when fuzzing) - Adds a JsNativeError variant, denoting when the number of instructions has been exceeded (only available when fuzzing) - Adds a VM fuzzer which looks for cases where Boa may crash on an input This offers no guarantees about correctness, only assertion violations. Depends on #2400. Any issues I raise in association with this fuzzer will link back to this fuzzer. You may run the fuzzer using the following commands: ```bash $ cd boa_engine $ cargo +nightly fuzz run -s none vm-implied ``` Co-authored-by: Addison Crump <addison.crump@cispa.de>
2 years ago
[[bin]]
name = "vm-implied"
path = "fuzz_targets/vm-implied.rs"
test = false
doc = false
[[bin]]
name = "bytecompiler-implied"
path = "fuzz_targets/bytecompiler-implied.rs"
test = false
doc = false