Skip to content
Branch: master
Find file History
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
..
Failed to load latest commit information.
README.md
avoid-known-bugs.js
built-in-constructors.js Convert eslint-disable-line notations to use the /* */ syntax instead… Mar 22, 2019
detect-engine.js Convert eslint-disable-line notations to use the /* */ syntax instead… Mar 22, 2019
driver.js
error-reporting.js Convert eslint-disable-line notations to use the /* */ syntax instead… Mar 22, 2019
gen-asm.js
gen-grammar.js Thoroughly kill off window since it throws a ReferenceError in the sh… Mar 23, 2019
gen-math.js Convert eslint-disable-line notations to use the /* */ syntax instead… Mar 22, 2019
gen-proxy.js Convert eslint-disable-line notations to use the /* */ syntax instead… Mar 22, 2019
gen-recursion.js Convert eslint-disable-line notations to use the /* */ syntax instead… Mar 22, 2019
gen-regex.js Convert eslint-disable-line notations to use the /* */ syntax instead… Mar 22, 2019
gen-stomp-on-registers.js Convert eslint-disable-line notations to use the /* */ syntax instead… Mar 22, 2019
gen-type-aware-code.js Tweak probability of generating objects with types again, the previou… Mar 23, 2019
mess-grammar.js
mess-tokens.js Convert eslint-disable-line notations to use the /* */ syntax instead… Mar 22, 2019
preamble.js
run-in-sandbox.js
run-reduction-marker.js
run.js Convert eslint-disable-line notations to use the /* */ syntax instead… Mar 22, 2019
tail.js
test-asm.js Convert eslint-disable-line notations to use the /* */ syntax instead… Mar 22, 2019
test-consistency.js Convert eslint-disable-line notations to use the /* */ syntax instead… Mar 22, 2019
test-math.js Convert eslint-disable-line notations to use the /* */ syntax instead… Mar 22, 2019
test-misc.js
test-regex.js Convert eslint-disable-line notations to use the /* */ syntax instead… Mar 22, 2019

README.md

jsfunfuzz creates random JavaScript function bodies (including invalid ones) to test many parts of JavaScript engines.

The largest module of jsfunfuzz is gen-grammar.js. thinking loosely in terms of "statements", "expressions", "lvalues", "literals", etc. It's almost a context-free grammar fuzzer... |cat| and |totallyRandom| especially make it seem like one.

Once it creates a function body, it does the following things with it:

  • Splits it in half and tries to compile each half, mostly to find bugs in the compiler's error-handling.
  • Compiles it
  • Executes it
  • If executing returned a generator, loops through the generator.

Running jsfunfuzz

To test an existing SpiderMonkey shell called ./js, run:

<python executable> -m funfuzz.js.loop --random-flags --compare-jit 20 mozilla-central ./js

  • --random-flags tells it to use shell_flags to
  • --compare-jit tells it to run compare_jit on most of the generated code, detecting bugs where adding optimization flags like --ion-eager changes the output.
  • 20 tells it to kill any instance that runs for more than 20 seconds
  • mozilla-central or any other string is no longer used, and this argument will be removed in the future.

If loop detects a new bug, it will run Lithium to reduce the testcase. It will call Lithium with either js_interesting or compare_jit as the "interestingness test".

Using funfuzz.bot, you can automate downloading or building new versions of the SpiderMonkey shell, and running several instances of loop for parallelism.

Through randorderfuzz, if the harness detects tests in the mozilla-central tree, it may load or incorporate tests into its fuzzing input in a random order.

Contributors

You can’t perform that action at this time.