Add fuzzing code to CI (#111)

* Add fuzzing code to CI

* fix fuzz suite from breaking changes

Author: untitaker

.github/workflows/fuzz.yml

@@ -0,0 +1,19 @@
+# This workflow doesn't do fuzzing, it just ensures that the fuzzing code can compile
+
+name: Fuzz check
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: stable
+      - run: cd fuzz
+      - run: cargo check

fuzz/Cargo.lock

@@ -14,7 +14,7 @@ pretty_assertions = "1.0.0"
 
 # thirdparty crates to fuzz against
 html5gum_old = { version = "=0.6.1", package = "html5gum" }
-html5ever = "0.27.0"
+html5ever = "0.29.0"
 swc_common = "3.0"
 swc_html_parser = "3.0"
 swc_html_ast = "3.0"

fuzz/Cargo.toml

@@ -1,3 +1,5 @@
+use std::cell::RefCell;
+
 use html5ever::buffer_queue::BufferQueue;
 use html5ever::tendril::format_tendril;
 use html5ever::tokenizer::{
@@ -8,11 +10,11 @@ use html5gum::{Emitter, Reader, Token};
 use pretty_assertions::assert_eq;
 
 pub fn run_html5ever(s: &str) {
-    let mut reference_tokenizer = html5ever::tokenizer::Tokenizer::new(
-        TokenSink {
+    let reference_tokenizer = html5ever::tokenizer::Tokenizer::new(
+        TokenSink(RefCell::new(TokenSinkInner {
             testing_tokenizer: html5gum::Tokenizer::new(s),
             carried_over_token: None,
-        },
+        })),
         TokenizerOpts {
             // the html5gum tokenizer does not handle the BOM, and also not discarding a BOM is
             // what the test suite expects, see https://github.com/html5lib/html5lib-tests/issues/2
@@ -31,19 +33,30 @@ pub fn run_html5ever(s: &str) {
     reference_tokenizer.end();
 }
 
-struct TokenSink<R: Reader, E: Emitter> {
+struct TokenSinkInner<R: Reader, E: Emitter> {
     testing_tokenizer: html5gum::Tokenizer<R, E>,
     carried_over_token: Option<Token>,
 }
 
+struct TokenSink<R: Reader, E: Emitter>(RefCell<TokenSinkInner<R, E>>);
+
 impl<R: Reader, E: Emitter<Token = Token>> html5ever::tokenizer::TokenSink for TokenSink<R, E> {
     type Handle = ();
 
     fn process_token(
-        &mut self,
+        &self,
         reference_token: html5ever::tokenizer::Token,
         _line_number: u64,
     ) -> TokenSinkResult<Self::Handle> {
+        self.0.borrow_mut().process_token(reference_token)
+    }
+}
+
+impl<R: Reader, E: Emitter<Token = Token>> TokenSinkInner<R, E> {
+    fn process_token(
+        &mut self,
+        reference_token: html5ever::tokenizer::Token,
+    ) -> TokenSinkResult<()> {
         if matches!(reference_token, Token2::ParseError(_)) {
             // TODO
             return TokenSinkResult::Continue;

fuzz/src/testcase/html5ever.rs

@@ -57,7 +57,7 @@ pub fn run_lolhtml(data: &[u8]) {
     }
 
     let mut gum_tokens = Vec::new();
-    for mut token in html5gum::Tokenizer::new(data).infallible() {
+    for Ok(mut token) in html5gum::Tokenizer::new(data) {
         match token {
             Token::Error(_) => continue,
             Token::StartTag(ref mut s) => {

fuzz/src/testcase/lolhtml.rs

@@ -10,8 +10,8 @@ pub fn run(s: &[u8]) {
 
     // unconditionally run tokenizer against raw bytes, it should never crash. we rely on running
     // in debug mode such that this is not just simply optimized away
-    let testing_tokenizer = html5gum::Tokenizer::new(s).infallible();
-    for _ in testing_tokenizer {}
+    let testing_tokenizer = html5gum::Tokenizer::new(s);
+    for Ok(_) in testing_tokenizer {}
 
     if env::var("FUZZ_OLD_HTML5GUM").unwrap() == "1" {
         if let Ok(data) = std::str::from_utf8(s) {

fuzz/src/testcase/mod.rs

@@ -5,11 +5,11 @@ use html5gum::{Doctype, EndTag, StartTag, Token};
 use pretty_assertions::assert_eq;
 
 pub fn run_old_html5gum(s: &str) {
-    let reference_tokenizer = html5gum_old::Tokenizer::new(s).infallible();
-    let testing_tokenizer = html5gum::Tokenizer::new(s).infallible();
+    let reference_tokenizer = html5gum_old::Tokenizer::new(s);
+    let testing_tokenizer = html5gum::Tokenizer::new(s);
 
-    let mut testing_tokens: Vec<_> = testing_tokenizer.collect();
-    let mut reference_tokens: Vec<_> = reference_tokenizer.collect();
+    let Ok(mut testing_tokens): Result<Vec<_>, _> = testing_tokenizer.collect();
+    let Ok(mut reference_tokens): Result<Vec<_>, _> = reference_tokenizer.collect();
 
     fn isnt_error(x: &html5gum::Token) -> bool {
         !matches!(*x, html5gum::Token::Error(_))

fuzz/src/testcase/old_html5gum.rs

@@ -91,7 +91,7 @@ pub fn run_swc(s: &str) {
     }
 
     let mut gum_tokens = vec![];
-    for token in html5gum::Tokenizer::new(s).infallible() {
+    for Ok(token) in html5gum::Tokenizer::new(s) {
         match token {
             html5gum::Token::Error(_) => {}
             token => gum_tokens.push(token),