Skip to content

Conversation

@untitaker
Copy link
Contributor

@untitaker untitaker commented Dec 10, 2021

This is a curious testcase because html5ever appears to be failing it.
At least piping it to html5ever like so appears to produce:

$ echo -n -e "<D/0=&\r0='>" | cargo run --example tokenize Finished dev [unoptimized + debuginfo] target(s) in 0.04s Running `target/debug/examples/tokenize` ERROR: Bad character TAG : <d 0='&0=''> OTHER: EOFToken Tokenizer profile, in nanoseconds 23885 total in token sink 44610 total in tokenizer 27019 60.6% AttributeValue(Unquoted) 5158 11.6% Data 4669 10.5% TagOpen 2174 4.9% TagName 1753 3.9% SelfClosingStartTag 1413 3.2% BeforeAttributeName 1382 3.1% BeforeAttributeValue 1042 2.3% AttributeName 

I could not find an older revision of the spec (in w3 or whatwg) that
would explain this behavior.

It's late and I'm tired, but I believe my reading of the spec is correct
and this should not emit a tag.

This is a curious testcase because html5ever appears to be failing it. At least piping it to html5ever like so appears to produce: ``` $ cargo run -p html5ever --example tokenize < ~/projects/html5gum/fuzz/mintest Finished dev [unoptimized + debuginfo] target(s) in 0.04s Running `target/debug/examples/tokenize` ERROR: Bad character TAG : <d 0='&0=''> CHAR : "\n" OTHER: EOFToken Tokenizer profile, in nanoseconds 31248 total in token sink 43594 total in tokenizer 24126 55.3% AttributeValue(Unquoted) 7133 16.4% Data 4389 10.1% TagOpen 2986 6.8% SelfClosingStartTag 1363 3.1% BeforeAttributeValue 1283 2.9% BeforeAttributeName 1162 2.7% TagName 1152 2.6% AttributeName ``` I could not find an older revision of the spec (in w3 or whatwg) that would explain this behavior. It's late and I'm tired, but I believe my reading of the spec is correct and this should not emit a tag.
@untitaker
Copy link
Contributor Author

Forgot to mention, I'm running afl to find inconsistencies between html5gum and html5ever now. This is why I decided to create a separate file, to not clutter existing files as I add more to this. Do you think this belongs in one of the existing files?

@untitaker
Copy link
Contributor Author

I believe this testcase may add nothing new to the testsuite. I assumed it would be non-overlapping with existing testdata because it exhibits flaws in html5ever, however html5ever is lagging 4 years behind testsuite's main branch, see servo/html5ever#459

Not sure what to do with this or how to best check that this testcase adds something new.

@untitaker
Copy link
Contributor Author

Nevermind, I think this should be covered already.

@untitaker untitaker closed this Dec 16, 2021
@untitaker untitaker deleted the fuzz-open-attribute branch December 16, 2021 18:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant