fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. - #1225
Merged
Conversation
keithamus
force-pushed
the
fuzz/findings-20260615-035522
branch
from
June 15, 2026 20:56
9cad98c to
9be453f
Compare
✅ CI passed
|
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 15, 2026
## [0.0.26] - 2026-06-15 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) [forcebuild]
Merged
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 15, 2026
## [0.0.26] - 2026-06-15 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222))
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 15, 2026
## [0.0.26] - 2026-06-15 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Css_lexer - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) [forcebuild]
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 15, 2026
## [0.0.26] - 2026-06-15 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Css_lexer - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222))
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 19, 2026
## [0.0.26] - 2026-06-19 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Css_lexer - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) ### Css_parse - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) [forcebuild]
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 19, 2026
## [0.0.26] - 2026-06-19 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Css_lexer - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) ### Css_parse - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222))
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 19, 2026
## [0.0.26] - 2026-06-19 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Css_lexer - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) ### Css_parse - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) [forcebuild]
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 19, 2026
## [0.0.26] - 2026-06-19 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Css_lexer - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) ### Css_parse - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222))
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 19, 2026
## [0.0.26] - 2026-06-19 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Css_lexer - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) ### Css_parse - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) - csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234)) [forcebuild]
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 19, 2026
## [0.0.26] - 2026-06-19 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Css_lexer - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) ### Css_parse - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) - csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234))
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 20, 2026
## [0.0.26] - 2026-06-20 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Css_lexer - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) ### Css_parse - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) - csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234)) - csskit(node): manage wasm-opt with mise (#1235) ([#1235](#1235)) - csskit(node): Move build script to Mise (#1237) ([#1237](#1237)) [forcebuild]
github-actions Bot
pushed a commit
that referenced
this pull request
Jun 20, 2026
## [0.0.26] - 2026-06-20 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Css_lexer - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) ### Css_parse - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) - csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234)) - csskit(node): manage wasm-opt with mise (#1235) ([#1235](#1235)) - csskit(node): Move build script to Mise (#1237) ([#1237](#1237))
keithamus
added a commit
that referenced
this pull request
Jun 20, 2026
- Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) - csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234)) - csskit(node): manage wasm-opt with mise (#1235) ([#1235](#1235)) - csskit(node): Move build script to Mise (#1237) ([#1237](#1237)) [forcebuild]
keithamus
added a commit
that referenced
this pull request
Jun 20, 2026
- Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) - csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234)) - csskit(node): manage wasm-opt with mise (#1235) ([#1235](#1235)) - csskit(node): Move build script to Mise (#1237) ([#1237](#1237)) [forcebuild]
keithamus
added a commit
that referenced
this pull request
Jun 20, 2026
- Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) - csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234)) - csskit(node): manage wasm-opt with mise (#1235) ([#1235](#1235)) - csskit(node): Move build script to Mise (#1237) ([#1237](#1237)) [forcebuild]
keithamus
added a commit
that referenced
this pull request
Jun 20, 2026
## [0.0.26] - 2026-06-20 ### Other Changes - Chore(deps): update dependencies to v1.48.0 (#1227) ([#1227](#1227)) ### Css_ast - Regenerate css_ast/src/values from csswg drafts (#1221) ([#1221](#1221)) - fuzz(css_parse): Mark more erroneous tokens in blocks as trivia. (#1225) ([#1225](#1225)) ### Css_lexer - fuzz(css_lex): avoid buffer overflows with SmallStr buffer (#1220) ([#1220](#1220)) ### Css_parse - fuzz(css_parse): consume `Bad` tokens as trivia in blocks. (#1228) ([#1228](#1228)) ### Csskit - chore(deps): update dependencies (patch) (#1222) ([#1222](#1222)) - csskit_wasm/csskit(node): Provide csskit library functions in csskit package (#1234) ([#1234](#1234)) - csskit(node): manage wasm-opt with mise (#1235) ([#1235](#1235)) - csskit(node): Move build script to Mise (#1237) ([#1237](#1237))
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Nightly fuzz run found new findings.
In #1183 we avoided hanging on CDC/CDO tokens inside of blocks by consuming those. This fuzz run discovered that more tokens can cause similar hangs, as they're not consumed by ComponentValues.
This change fixes these hangs by implementing a KindSet to skip CDC/CDO, Semicolon, RightParen and RightSquare tokens, and then consume them all as trivia. This has the nice side effect of fixing the slightly strange issue left in #1183, of it consuming the token and never outputting it (which would be bad for e.g. formatting).
GHA run: https://github.com/csskit/csskit/actions/runs/27521379133
Findings
minimized-from-d96fe2791e4630226a4b13ce2f629828a532c2f8(372 bytes)minimized-from-2c26c01866b29fadbecca76d8cbd89725f38d631(13 bytes){--ty-2% {90)minimized-from-2bb88d5f8f391013ac91867b81510f2cdb7e0cbf(18 bytes){--ty-25% {950) 95minimized-from-89fede4a5e7de2f025539a70d3ad215fca0deab7(59 bytes)minimized-from-4aa1eda2f088e1660045d87a79987a92f47770d6(426 bytes)minimized-from-9ba8451fb67ae5cccc02218b86a15df6ac2b455e(12 bytes){-ty-2% {90)minimized-from-fbb6812c1fa52251705facd0245da82307c8afcb(741 bytes)minimized-from-fbdb5cf68a6a558e9ac4c969b8768c9810a7a743(16 bytes){--ty-2% {90) 95minimized-from-2cdfe30d8243003a08e5a61fa07546ec921d85ed(33 bytes){--ty-25% {950) scalacity:0.95.95minimized-from-0fedf1fe49ed79d6812c99d9e17ad65b395b3741(48 bytes){--ty-25% {950) scaleY(0{--tw-bg-opacity:0.95.95minimized-from-fd586001f45b01c8f961f0a3ae2a2b233a8b0e61(7 bytes)t% {90)minimized-from-2acf8f531d6546c4695732bb1fa2f9f200d7cd72(3 bytes)%{)minimized-from-783f5025c3d50524c51f04ec7a0dec6a0e1dbfb8(95 bytes)minimized-from-dffc7face542bc65516c3c94eb24ad24333e276e(248 bytes)minimized-from-b325285093ae0ff738f95c83b936cface3cd74d8(291 bytes)minimized-from-80e799a5a77c7253b70f073c7016e8efb9d00334(551 bytes)minimized-from-1ab2623f55308b7646d3d051fb46bbe5d11dc2a2(1140 bytes)minimized-from-25753e5421d5da230ae261f3d8e131bf604f0c79(126 bytes)minimized-from-59db0f200b3959635517a048c988887fe0c882fe(9 bytes){-t% {90)minimized-from-6cf22811f035290ae7b76627be4d944da10e9a9e(17 bytes){--ty-25% {90) 95minimized-from-693b4035181b920040791e73a5fd6c8036fa1ed8(176 bytes)minimized-from-38131bb1f6191a8fb250b9f9091be688127d4612(64 bytes)minimized-from-2d7301773f41a70928b1cac67a5ed31bd0c8e0ce(749 bytes)minimized-from-0013179044f316862bd94e8389510c9b0e439d99(5 bytes)t% {)minimized-from-05d1f3d60ea8888709aa85453101b9a2b3d573be(60 bytes)minimized-from-a37b649c0da3910cb2d58317075a716fbee82868(4 bytes)t%{)minimized-from-9b8bea97c517de4d15fe19f46741e3ede84abc8d(71 bytes)