forked from MozillaSecurity/funfuzz
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathmess-tokens.js
More file actions
128 lines (106 loc) · 2.96 KB
/
mess-tokens.js
File metadata and controls
128 lines (106 loc) · 2.96 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
// Each input to |cat| should be a token or so, OR a bigger logical piece (such as a call to makeExpr). Smaller than a token is ok too ;)
// When "torture" is true, it may do any of the following:
// * skip a token
// * skip all the tokens to the left
// * skip all the tokens to the right
// * insert unterminated comments
// * insert line breaks
// * insert entire expressions
// * insert any token
// Even when not in "torture" mode, it may sneak in extra line breaks.
// Why did I decide to toString at every step, instead of making larger and larger arrays (or more and more deeply nested arrays?). no particular reason.
function cat(toks)
{
if (rnd(1700) === 0)
return totallyRandom(2, ["x"]);
var torture = (rnd(1700) === 57);
if (torture)
dumpln("Torture!!!");
var s = maybeLineBreak();
for (var i = 0; i < toks.length; ++i) {
// Catch bugs in the fuzzer. An easy mistake is
// return /*foo*/ + ...
// instead of
// return "/*foo*/" + ...
// Unary plus in the first one coerces the string that follows to number!
if (typeof(toks[i]) != "string") {
dumpln("Strange item in the array passed to cat: typeof toks[" + i + "] == " + typeof(toks[i]));
dumpln(cat.caller);
dumpln(cat.caller.caller);
}
if (!(torture && rnd(12) === 0))
s += toks[i];
s += maybeLineBreak();
if (torture) switch(rnd(120)) {
case 0:
case 1:
case 2:
case 3:
case 4:
s += maybeSpace() + totallyRandom(2, ["x"]) + maybeSpace();
break;
case 5:
s = "(" + s + ")"; // randomly parenthesize some *prefix* of it.
break;
case 6:
s = ""; // throw away everything before this point
break;
case 7:
return s; // throw away everything after this point
case 8:
s += UNTERMINATED_COMMENT;
break;
case 9:
s += UNTERMINATED_STRING_LITERAL;
break;
case 10:
if (rnd(2))
s += "(";
s += UNTERMINATED_REGEXP_LITERAL;
break;
default:
}
}
return s;
}
// For reference and debugging.
/*
function catNice(toks)
{
var s = ""
var i;
for (i=0; i<toks.length; ++i) {
if(typeof(toks[i]) != "string")
confused("Strange toks[i]: " + toks[i]);
s += toks[i];
}
return s;
}
*/
var UNTERMINATED_COMMENT = "/*"; /* this comment is here so my text editor won't get confused */
var UNTERMINATED_STRING_LITERAL = "'";
var UNTERMINATED_REGEXP_LITERAL = "/";
function maybeLineBreak()
{
if (rnd(900) === 3)
return Random.index(["\r", "\n", "//h\n", "/*\n*/"]); // line break to trigger semicolon insertion and stuff
else if (rnd(400) === 3)
return rnd(2) ? "\u000C" : "\t"; // weird space-like characters
else
return "";
}
function maybeSpace()
{
if (rnd(2) === 0)
return " ";
else
return "";
}
function stripSemicolon(c)
{
var len = c.length;
if (c.charAt(len - 1) == ";")
return c.substr(0, len - 1);
else
return c;
}