Crash in v8::internal::wasm::SR_WasmDecoder::CreateOrMergeIntoPhi |
||||||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=4768812204818432 Fuzzer: mbarbella_js_mutation Job Type: linux_asan_d8_v8_mipsel_dbg Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00000024 Crash State: v8::internal::wasm::SR_WasmDecoder::CreateOrMergeIntoPhi v8::internal::wasm::SR_WasmDecoder::MergeIntoProduction v8::internal::wasm::SR_WasmDecoder::Reduce Regressed: V8: r34586:34587 Minimized Testcase (0.46 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv97pNBvMCc6mEblxBVglPUDMeeCwRZjHlmYrcy-dbCF68s5W2QcRi-V4f_Pu4vzDOF1WWbdZuzoTirU9eBppRfPwA39uLESFkVTAOYXn3kLCSY3uqJwg2U8TcqHQ-4-9GK6eK5XLDYGh12EUrOdWP8cnxH9oFQ function __f_55(expected, __f_70, __f_11) { Wasm.instantiateModuleFromAsm( __f_70.toString()); } function __f_71() { "use asm"; function __f_42(__v_25, __v_27) { __v_25 = +__v_25; __v_27 = +__v_27; return +(__v_25 + __v_27); } function __f_22() { var __v_25 = +__f_42(70.1,10.2); var __v_14 = 0|0; if (__v_25 == 80.3) { __v_14 = 1|0; } else { __v_14 = __v_25; } } return {__f_22: __f_22}; } __f_55(1, __f_71); Filer: mstarzinger See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
May 3 2016
This looks like it should be a type error in __f22 above. __v_14 is assigned an integer value in the true branch and a double value in the false branch.
,
Jun 20 2016
,
Jun 20 2016
,
Jun 20 2016
,
Jun 20 2016
,
Jun 20 2016
,
Jun 28 2016
ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4768812204818432 Fuzzer: mbarbella_js_mutation Job Type: linux_asan_d8_v8_mipsel_dbg Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00000024 Crash State: v8::internal::wasm::SR_WasmDecoder::CreateOrMergeIntoPhi v8::internal::wasm::SR_WasmDecoder::MergeIntoProduction v8::internal::wasm::SR_WasmDecoder::Reduce Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97BK_nDfLWBFfVTI8RvZ5HPn8Afie1KBZWxr04Pg-yQ8PnusFJ7x4uJhp590OiNobjuAwtFNEBF2wSTaXAQW8sbZUi4h6tO46a4DOSBasMcVQpRXn_NbWMHX9G1ylPDvVxVXzlsSz8gTBZJ3gYo1yriLiZmxTIaSlpubCiuURVHgSbasJI?testcase_id=4768812204818432 See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jan 9 2017
Is this fixed?
,
Jan 10 2017
Obsoleted by code churn. Closing. |
||||||||||
►
Sign in to add a comment |
||||||||||
Comment 1 by mstarzinger@chromium.org
, Apr 25 2016Status: Assigned (was: Available)