Skip to content

Commit

Permalink
Added a new fuzzer and fixed a few bugs (only for weird error constru…
Browse files Browse the repository at this point in the history
…ctions) found by it
  • Loading branch information
pvdz committed Oct 6, 2011
1 parent 0ba4509 commit 6e9180c
Show file tree
Hide file tree
Showing 6 changed files with 72 additions and 10 deletions.
10 changes: 6 additions & 4 deletions Gui.Nav.js
Expand Up @@ -575,9 +575,7 @@ Gui.Nav.prototype = {
this.injectButton.onclick = function(_, testName){
Ast.injectName = testName || prompt('Enter name of function callback', 'callme') || 'callme';
var ast = new Ast(this.gui.zeon.tree, this.gui.zeon.btree); // this will be my new structure in the next iteration
// Ast.getHeatPlate()+
this.gui.setValue(ast.heatmap());
//this.beautifyButton.onclick();
}.bind(this);
this.toolMenu.appendChild(this.injectButton);
},
Expand Down Expand Up @@ -952,13 +950,17 @@ setTimeout(function(){
var code = false;
while (!code) {
try {
switch (Math.floor(Math.round()*3)) {
if (true) var code = crapFuzzer();
else switch (Math.floor(Math.round()*4)) {
case 0:
var code = fuzzRuderManOrg(19);
break;
case 1:
var code = fuzzRudermanMod(19);
break;
case 2:
var code = crapFuzzer();
break;
default:
var code = fuzzZee();
break;
Expand All @@ -981,7 +983,7 @@ setTimeout(function(){
screwed = null;
} finally {
if (screwed) {
setTimeout(function(){ console.log(screwed); });
setTimeout(function(){ console.log(screwed); },10);
}
}
}.bind(this), 1);
Expand Down
2 changes: 2 additions & 0 deletions Gui.js
Expand Up @@ -1063,6 +1063,8 @@ Gui.prototype = {
if (match.name == 14/*error*/) {
// show error before the trailing whitespace, rather than after. unless match.errorHasContent is true.
var prev = match.errorHasContent ? match : (this.zeon.btree[match.tokposb-1] || match);
while (prev && prev.name == 14/*error*/) prev = this.zeon.btree[prev.tokposb-1]; // prevents a possible error with prev.lineId not being defined
if (!prev) prev = match; // with errors, there might not be a black token at all...
this.showErrorMark(prev);

// for tokenizer errors, show the content anyways
Expand Down
16 changes: 10 additions & 6 deletions Zeon.js
Expand Up @@ -1376,7 +1376,7 @@ Zeon.prototype = {
var minValue = this.precedence[stack[1].sub];
var n = 3;
var wasLess = false;
while (n < stack.length-1) {
while (n < stack.length-1 && stack[n][0]) { // check for stack[n][0] is because it might not exist if an error was thrown.
stack[n][0].isAmbiguous = true;
var curValue = this.precedence[stack[n].sub];
if (curValue < minValue || (curValue == minValue && (stack[n].isAssignment || stack[n].sub == '?' || stack[n].sub == ':'))) {
Expand Down Expand Up @@ -2206,7 +2206,7 @@ Zeon.prototype = {
if (token.value == 'typeof') stack.hasTypeof = true;

// if you declare a function param or catch scope param with single underscore, no error is given, its assuming you want that to be empty
if (token.varNameDecl && !token.trackingObject.used && ((token.meta != 'parameter' && !token.isCatchVar) || token.value != '_')) { // since it was declared, it should exist in the scope.
if (token.varNameDecl && token.trackingObject && !token.trackingObject.used && ((token.meta != 'parameter' && !token.isCatchVar) || token.value != '_')) { // since it was declared, it should exist in the scope.
token.unused = true;
}

Expand Down Expand Up @@ -3811,7 +3811,7 @@ Zeon.prototype = {
rest = rest.filter(function(token){
var isFunction = token.isFuncExprKeyword || token.isFuncDeclKeyword;
var to = token.trackingObject;
var typerefs = (isFunction?token.typeRefs:to.typeRefs);
var typerefs = (isFunction?token.typeRefs:to&&to.typeRefs);

if (typerefs) {
typerefs = typerefs.filter(function(ref){
Expand Down Expand Up @@ -3906,7 +3906,7 @@ Zeon.prototype = {
if (isFunction) token.typeRefs = typerefs;
else to.typeRefs = typerefs;
}
return true;
return false;
},this);
}

Expand Down Expand Up @@ -4128,10 +4128,11 @@ Zeon.prototype = {
}
}
}
console.log(["unhandled case", stack.desc, stack]);
if (!this.hasError) console.log(["unhandled case", stack.desc, stack]);
},

getType: function(stack){
if (this.hasError && !stack) return false; // can sometimes happen, ex: `[a.[`
if (stack.desc == 'expressions') return this.getTypeExpressions(stack);
else if (stack.desc == 'expression') return this.getTypeExpression(stack);
else if (stack.desc == 'sub-expression') return this.getTypeSubExpression(stack);
Expand Down Expand Up @@ -4323,7 +4324,10 @@ Zeon.prototype = {
else if (token.isArrayLiteralStart) lastType = token;
// return objlit stack
else if (token.isObjectLiteralStart) {
if (!token.definedProperties) throw 'no props?'; // even on an empty objlit this array should exist (albeit empty)
if (!token.definedProperties) {
if (this.hasError) return lastType; // happens for instance with: `d[{`
else throw 'no props?'; // even on an empty objlit this array should exist (albeit empty)
}
// return the token, that way we can bind a ref later (if we want to). just make sure this is not an array.
// see addTypeToVarStack()
lastType = token;
Expand Down
1 change: 1 addition & 0 deletions console.html
Expand Up @@ -1169,6 +1169,7 @@ <h1>Zeon.js console</h1>
<script src="fuzzing/fuzzRuderManOriginal.js"></script>
<script src="fuzzing/fuzzRuderManEdited.js"></script>
<script src="fuzzing/fuzzZee.js"></script>
<script src="fuzzing/crapper.js"></script>

<script src="Zeon.js"></script>
<script>
Expand Down
51 changes: 51 additions & 0 deletions fuzzing/crapper.js
@@ -0,0 +1,51 @@
var crapFuzzer = function(){
var set = [
'a',
'b',
'c',
'd',
'e',
'f',
'g',
'h',
'var',
'if',
'else',
'while',
'return',
'break',
'continue',
'throw',
'do',
'for',
'switch',
'case',
'default',
'try',
'catch',
'finally',
'function',
'true','false',
'null','undefined',
'void',
'0x',
'0','1','2','3','4','5','6','7','8','9',
'.','[',']','{','}','(',')','+','-','*','/','&','^','%','$','!','~','in','instanceof','delete','new','void'
];


var s = 'function x(';
if (Math.random()<0.5) s += 'h';
var n = ~~(Math.random()*5);
while (n--) s += ','+set[n];
s += '){';

var next;
while (!next || s.length+next.length < 139) {
if (next) s += next+' ';
next = set[~~(Math.random()*set.length)];
}
s += '}';
return s;
};
//var timer = setInterval(function(){ if (gui.zeon.hasError) gui.setValue(rnd()); }, 20);
2 changes: 2 additions & 0 deletions zeparser/ZeParser.js
Expand Up @@ -1079,6 +1079,7 @@ ZeParser.prototype = {
// )
// statement
// [else statement]
var ifKeyword = match;
match = this.tokenizer.storeCurrentAndFetchNextToken(false, match, stack);
if (match.value != '(') match = this.failsafe('ExpectedStatementHeaderOpen', match);
if (this.ast) { //#ifdef FULL_AST
Expand All @@ -1104,6 +1105,7 @@ ZeParser.prototype = {

// match might be null here... (if the if-statement was end part of the source)
if (match && match.value == 'else') {
ifKeyword.hasElse = match;
match = this.eatElse(match, stack);
}

Expand Down

0 comments on commit 6e9180c

Please sign in to comment.