[Bug]: Dependency on jazzer.js breaks Linux builds

[wvanrensburg]

Attach (recommended) or Link to PDF file

NA

Web browser and its version

NA

Operating system and its version

Linux

PDF.js version

4.9 & 4.10

Is the bug present in the latest PDF.js version?

Yes

Is a browser extension

No

Steps to reproduce the problem

Within Linux...
git clone https://github.com/mozilla/pdf.js.git
npm i
^ Fails here with Error

13.64 npm error code 127
13.64 npm error path /usr/local/pdfjs/pdf.js/node_modules/@jazzer.js/fuzzer
13.64 npm error command failed
13.64 npm error command sh -c prebuild-install --runtime napi || npm run prebuild
13.64 npm error > @jazzer.js/[email protected] prebuild
13.64 npm error > prebuild --runtime napi --backend cmake-js --all --strip --verbose
13.64 npm error prebuild-install warn install No prebuilt binaries found (target=4 runtime=napi arch=arm64 libc= platform=linux)
13.64 npm error sh: 1: prebuild: not found

Link to Jazzer.js filed bug: CodeIntelligenceTesting/jazzer.js#795

What is the expected behavior?

To Build successfully

What went wrong?

Build Failed

Link to a viewer

No response

Additional context

No response

[Snuffleupagus]

@calixteman, @marco-c Has the tests in https://github.com/mozilla/pdf.js/tree/master/test/fuzz generated any warnings from OSS-Fuzz, since I'm not aware of issues referencing it?

If not, I'd question if it's actually worthwhile to even keep these tests in the PDF.js code-base!

[calixteman]

If not, I'd question if it's actually worthwhile to even keep these tests in the PDF.js code-base!

I was wondering exactly the same question...
To answer to your question, I don't think so, as far as I remember we never had any bug reports and I don't know if something is running that stuff somewhere... Maybe @marco-c knows.

[Snuffleupagus]

Additionally, according to its README it seems that Jazzer.js is no longer being maintained (since almost a year) which on its own seems like reason enough to remove these tests.

[Snuffleupagus]

Additionally, according to its README it seems that Jazzer.js is no longer being maintained (since almost a year) which on its own seems like reason enough to remove these tests.

Even worse, it seems that Jazzer.js is now also causing permanent breakage in the Node.js v23 CI job.

[calixteman]

That stuff never proved that it was useful.
If an image is ill-formatted and if our code doesn't handle the case, then an exception will be thrown and the rendering will be just wrong, but there is no specific risk to generate a sec issue.
So @marco-c and I decided to remove that stuff.
That said if someone is able to prove that it's worth using it then we can make up our mind to add it back.