http://www.squarefree.com/2011/09/01/lessons-from-js-engine-bugs/ Jesse Ruderman on Firefox, security, and more Fri, 02 Mar 2012 12:46:07 +0000 hourly 1 http://wordpress.org/?v=3.5.1 http://www.squarefree.com/2011/09/01/lessons-from-js-engine-bugs/comment-page-1/#comment-12324 Benjamin Otte Fri, 02 Sep 2011 12:17:15 +0000 http://www.squarefree.com/?p=791#comment-12324 About OOM fuzzing: The method that I have tried and found to be reasonably fast is to fork(), return NULL in the child and see if it terminates properly. The parent would continue without failures. (I wrote that up in http://blogs.gnome.org/otte/2007/11/03/robustness-testing/ but the links from there are all gone.) IIRC that method was something like 30x slower than normal execution of the program, but it at least was essentially O(runtime of original program).
Also, it gets tricky when your code writes to files/sockets, but for a JS engine you should be able to avoid that.

]]>