FFPuppet is a Python module that automates browser process related tasks to aid in fuzzing. Happy bug hunting!
To install the latest version from PyPI
pip install ffpuppet
Xvfb on Linux
xvfb can be used in order to run headless (this is not the same as Firefox's
xvfb on Ubuntu run:
apt-get install xvfb
minidump_stackwalk is used to extract a crash report when the browser crashes without a debugger (GDB/Valgrind) or instrumentation (ASan). If desired,
minidump_stackwalk should be installed in the users path after obtaining it from FirefoxCI. Choose the appropriate tool for your platform (
win32-minidump-stackwalk, etc.), choose
latest, then extract the executable from the downloaded tar archive.
If you are looking for builds to use with FFPuppet there are a few options.
fuzzfetch is the recommended method for obtaining builds and is also very helpful in automation.
Taskcluster has a collection of many different build types for multiple platforms and branches. An index of the latest mozilla-central builds can be found here.
Build your own
If you would like to compile your own, build instructions can be found here.
Once installed FFPuppet can be run using the following command:
python -m ffpuppet usage: ffpuppet [-h] [-d] [--log-level LOG_LEVEL] [-e EXTENSION] [-p PREFS] [-P PROFILE] [-u URL] [--xvfb] [-a ABORT_TOKEN] [--launch-timeout LAUNCH_TIMEOUT] [-l LOGS] [--log-limit LOG_LIMIT] [-m MEMORY] [--poll-interval POLL_INTERVAL] [--save-all] [--gdb | --pernosco | --rr | --valgrind] binary FFPuppet - Firefox process launcher and log collector. Happy bug hunting! positional arguments: binary Firefox binary to launch optional arguments: -h, --help show this help message and exit -d, --display-logs Display summary of browser logs on process exit. --log-level LOG_LEVEL Configure console logging. Options: DEBUG, INFO, WARN, ERROR (default: INFO) Browser Configuration: -e EXTENSION, --extension EXTENSION Install extensions. Specify the path to the xpi or the directory containing the unpacked extension. -p PREFS, --prefs PREFS Custom prefs.js file to use (default: profile default) -P PROFILE, --profile PROFILE Profile to use. This is non-destructive. A copy of the target profile will be used. (default: temporary profile) -u URL, --url URL Server URL or path to local file to load. --xvfb Use Xvfb. (Linux only) Issue Detection & Reporting: -a ABORT_TOKEN, --abort-token ABORT_TOKEN Scan the browser logs for the given value and close browser if detected. For example '-a ###!!! ASSERTION:' would be used to detect soft assertions. --launch-timeout LAUNCH_TIMEOUT Number of seconds to wait for the browser to become responsive after launching. (default: 300) -l LOGS, --logs LOGS Location to save browser logs. A sub-directory containing the browser logs will be created. --log-limit LOG_LIMIT Browser log file size limit in MBs (default: 0, no limit) -m MEMORY, --memory MEMORY Browser memory limit in MBs (default: 0, no limit) --poll-interval POLL_INTERVAL Delay between checks for results (default: 0.5) --save-all Always save logs. By default logs are saved only when an issue is detected. Available Debuggers: --gdb Use GDB. (Linux only) --pernosco Use rr. Trace intended to be submitted to Pernosco. (Linux only) --rr Use rr. (Linux only) --valgrind Use Valgrind. (Linux only)
Replaying a test case
python -m ffpuppet <firefox_binary> -p <custom_prefs.js> -d -u <testcase>
This will open the provided test case file in Firefox using the provided prefs.js file and any log data (stderr, stdout, ASan logs... etc) will be dumped to the console when the browser process terminates. Grizzly Replay is recommended for replaying test cases.
prefs.js files that can be used for fuzzing or other automated testing can be generated with PrefPicker.