New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 599413 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Last visit > 30 days ago
Closed: Jun 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

(left_index == right_index) || (ignore_sign && (left_index <= 1) && (right_index

Project Member Reported by ClusterFuzz, Mar 31 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5025734954844160

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  (left_index == right_index) || (ignore_sign && (left_index <= 1) && (right_index
  

Minimized Testcase (0.29 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95poeHvlfzvzgwsfx_zPfkK-l_TfpspPJvDa13SQD4ApfBLHNJb_DSkLImgKhFSupapcDXnCpIpOvAgZjWBjncSfWbnVNBLiveftx5FQdTGuX2FxK4VzqulUI48D6XiCr4Qzp3iUUZ5kQy8xYS2FzIzgwztMA
function __f_55(expected, __f_70, __f_9) {
 Wasm.instantiateModuleFromAsm( __f_70.toString());
}
function __f_100() {
  "use asm";
  function __f_76() {
    var __v_39 = 0;
    outer: while (1) {
      while (__v_39 == 4294967295) {
      }
    }
  }
  return {__f_76: __f_76};
}
__f_55(11, __f_100);


Filer: hablich

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Owner: titzer@chromium.org
Status: Assigned (was: Available)
Cc: -mythria@chromium.org -rmcilroy@chromium.org -oth@chromium.org -mstarzinger@chromium.org
Owner: bradnelson@chromium.org
Looks like a sign comparison mismatch.
This should not validate, correct?
Labels: BlocksWasmLaunch
Labels: -BlocksWasmLaunch BlocksAsmWasmLaunch
Components: Platform>DevTools>JavaScript Blink>JavaScript>WebAssembly
Components: -Platform>DevTools>JavaScript
Labels: -Pri-1 Pri-2
Cc: ishell@chromium.org titzer@chromium.org mstarzinger@chromium.org
 Issue 592349  has been merged into this issue.
 Issue 593285  has been merged into this issue.
Cc: bradnelson@chromium.org
 Issue 617528  has been merged into this issue.
Cc: rossberg@chromium.org
 Issue 618602  has been merged into this issue.
Status: Started (was: Assigned)
Started in
https://codereview.chromium.org/2106683003
Project Member

Comment 14 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment