Files

3.9 KiB

Filbert review, row 154 round 3: approve

Candidate manifest cebca5145c899a362e938d36b26168070ad8cc01bfdc0c9f44a68eee07a005ca (195 paths), r3/candidate.patch (d709b2dd...) applied with --index to 850484a7d. The manifest matched before and after every run. Compared with r2, five paths changed: editor/BUILD.json, editor/model.mjs, src/public/editor.js, tests/docs-browser.test.mjs and tests/editor-browser.test.mjs.

My r2 change is fixed, and so are my non-blocking notes. No new findings.

Change from r2, fixed: BUILD.json records the shipped bundle

  • editor/BUILD.json:6-8 records src/public/editor.js as 9c881b13740fae2408717ad75fa1d85bfcfe3fa8b3af0f1b3f2e706c90e80fee, 758420 B. That is the shipped file.
  • I rebuilt with the pinned toolchain (lock eb60a494..., esbuild 0.28.2 binary e1698a3d..., toolchain check rc=0 under MOSAIC_REQUIRE_EDITOR_BUILD=1), both to a scratch --out and in place. In both, editor.js, editor.css (8654ac57..., 4462 B) and BUILD.json are byte for byte the same as the shipped files.
  • editor-provenance.test.mjs passes 6/6 under MOSAIC_REQUIRE_EDITOR_BUILD=1.

r2 notes, checked

  • Title backslashes.
    • model.mjs:172: titleBackslash doubles each backslash before the vendored link writer escapes ", so x\") is written as x\\\") and end\ as end\\.
    • :193: the image title escapes both characters in one pass (/[\\"]/g).
    • editor-browser.test.mjs:481-488 adds four tests. They cover a quote after a backslash then a tag, and a trailing backslash, each for a link title and an image title. Each asserts the exact written string, then re-reads the saved text with a read-only mount (:454-465).
  • g5. :492 pastes <pre data-params="ab">` and requires a bare fence on Save. My g5 is now killed by it.
  • docs-browser.test.mjs:67. The explicit document.querySelector("#doc-commit") check is back, as at :65.
  • Tilde wording. BUILD.md :419 and :464 now say a raw source block (pre.md-raw) inside the visual editor.

Non-blocking note

  • The re-read asserts haven't been shown to fail on their own. BUILD.md :490 says this itself: on every backslash mutant (Researcher's and my g1, g8 and g9) the exact-string assert fails first. I read :454-465, and the re-read checks the right things: the parsed title equals the pasted value, and no <img appears in the text. The exact-string assert already pins each written form, so the tests kill a wrong escape either way. I don't need that extra run.

Ran by me

Slot from sage-0858. The busy check was CLEAR before each step and after the last one. TMPDIR was in my own scratch, DOCKER_HOST was a dead socket, and MOSAIC_REQUIRE_EDITOR_BUILD=1 was set.

  • Rebuild, 19:09:28Z to 19:09:29Z. Results as above. The shipped files were restored afterwards and the manifest re-matched.
  • Singles, 19:09:35Z to 19:12:48Z.
    • Every packages/webui/tests/*.test.mjs file was run singly: 32 files, 206/206 by awk sum, 0 skipped.
    • That includes editor-browser 16/16, editor-provenance 6/6, editor 5/5 and docs-browser 1/1.
  • Mutants, 19:12:54Z to 19:15:58Z.
    • Both controls (editor-browser.test.mjs, editor.test.mjs) passed first.
    • Each model.mjs mutant was rebuilt into the bundle before its run, and the files were restored after each one.
    • 9 run, 9 killed:
      • g1 (link title not escaped at all): tests 7, 11, 13
      • g2: test 8
      • g3: test 9
      • g4: test 10
      • g5: test 15
      • g6: test 16
      • g7 (docShown never set, bus.js): tests 4, 5, 6
      • g8 (link backslash not doubled): tests 11, 13
      • g9 (image title escapes " only): tests 12, 14

Not mine

Researcher's r3 runs (BUILD.md "Round 3 results"): two byte-identical builds; singles 206/206; suite 206/206; 7 of 7 mutants killed; provenance 6/6 after the mutants; 195 of 195 manifest checks. I read the logs list and the mutant table, and did not rerun their script. My counts agree with theirs.