StyleValueTarget

Remarks

Reached by every animated property of every element, from text nobody validated. The value arrives from ExCSS already normalised, or from a var() substitution that ExCSS never saw — the second is the interesting one, because it is the author's characters passed through untouched. Numbers, units, hex colours, rgb() arguments and space-separated lists are all scanned by hand here, and every one of them is a length or an index derived from the input.

The parser is rebuilt each case rather than shared, and the reason is the Retained oracle rather than tidiness. Interning is what this parser does with an identifier it does not recognise, and a fuzz run's identifiers are distinct by construction — so a shared table would grow one entry per novel case forever and report the harness's own generator as a leak. Rebuilding moves the question from "how much does a run accumulate", which is unanswerable, to "how much does one parse accumulate", which is HeldCap and is a claim worth making.

Fields and properties (4)

• public string Name

  What to call it on a command line and in a report.

• public string What

  Which receive path this is, in one line.

• public long Held

  How many names one parse interned.

• public long HeldCap

  How many it may intern before that is the finding.

Methods (5)

• public StyleValueTarget()

  Creates the target.

• public long AllowanceFor(int inputLength)

  How many bytes an input may cause to be allocated.

• public void Maintain()

  Puts a fresh parser and fresh tables behind the next case.

• public void Seed(ICollection<byte[]> corpus)

  Adds well-formed inputs for the mutator to start from.

• public long Run(ReadOnlySpan<byte> input)

  Pushes one input through the decoder.

Used by (1)

• FuzzTargetsVixen.Fuzz