!locals_.has_sig() in src/wasm/encoder.cc |
|||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=4709832816328704 Fuzzer: mbarbella_js_mutation Job Type: linux_asan_d8_v8_arm_dbg Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: !locals_.has_sig() in src/wasm/encoder.cc Regressed: V8: r36291:36292 Minimized Testcase (0.31 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv94wowew22ytpzv-I0fB15RKhkLwHErZe4dMwdhxChY1DqkD_qPsTYKz_mJMFviZvC0eUDJVVEbMtOC0oRrf_80XoFS9YvQCXm0kNGLZPN4m68q28ms9FKfHExElng6W2H95H0jrO6LX2hZR7ZdaimWzv5dvDQ function __f_5() { return ( { }()); } __v_11 = { }; function __f_16(asmfunc) { var __v_10 = asmfunc.toString(); var __v_14 = Wasm.instantiateModuleFromAsm(__v_10); } function __f_17() { "use asm"; function __f_14() { return 1; } function __f_14() { return -1; } return { }; } __f_16(__f_17, { }); Filer: mstarzinger See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
May 18 2016
Looks like we are not rejecting functions with duplicate names in asm.js.
,
May 18 2016
,
Jun 8 2016
ClusterFuzz has detected this issue as fixed in range 36747:36748. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4709832816328704 Fuzzer: mbarbella_js_mutation Job Type: linux_asan_d8_v8_arm_dbg Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: !locals_.has_sig() in src/wasm/encoder.cc Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_d8_v8_arm_dbg&range=36747:36748 Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97MdLOpGeKPGzUGiFuRXbV9cih61umTuM9ahOEUh1J4RtJiIlpM1HHJn-znILwpJ0YPGO7hqpzDO6wrm23nVMU4Ra_css6gVCSRvv3YkgrRRriVK5zP631SokzGEUQQe4ADi3M6BOs4TexZDaJopWAF-OXyMQ See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jun 9 2016
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by mstarzinger@chromium.org
, May 18 2016Status: Assigned (was: Available)