New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 614291 link

Starred by 0 users

Issue metadata

Status: Fixed
Owner:
Closed: May 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

AllowHandleAllocation::IsAllowed() in src/heap/heap-inl.h

Project Member Reported by ClusterFuzz, May 24 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5692828894363648

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  AllowHandleAllocation::IsAllowed() in src/heap/heap-inl.h
  
Regressed: V8: r36206:36207

Minimized Testcase (0.36 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95-DnL4FBFMKrSH0xaXOE1Dyvh6BOVzqAuEl-0QaN904yjoBA6aH9UGUy9Y0V-ocZrAijAjXiIGoSYn3zyINq9FVcN5Epq137SvoAUF9PHFG1ngPVPC_Jz5bDJw0OMzKa9aSCY0ToqRwYJLZaQExJphEJE7Vw
function __f_55(expected, __f_70, __f_8) {
 Wasm.instantiateModuleFromAsm( __f_70.toString());
}
function __f_18() {
  "use asm";
  function __f_40(__v_22, __v_24) {
    __v_22 = __v_22|0;
    __v_24 = __v_24|0;
    var __v_23 = (__v_24 + 1)|0
    __v_26 = __v_22;
    var __v_26 = 3.0;
  }
  function __f_19() {
  }
  return {__f_19: __f_19};
}
__f_55(101,__f_18);


Filer: mstarzinger

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: titzer@chromium.org
Owner: ahaas@chromium.org
Status: Assigned (was: Available)
Regression range points to 4aec7ba1aa34e6b45618e0672ed1c2a0026e5b04 ...

Comment 2 by ahaas@chromium.org, May 24 2016

Cc: bradnelson@chromium.org
Project Member

Comment 3 by bugdroid1@chromium.org, May 25 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/f768e53cd8e20fa5e24a096b9a443940d8968cf1

commit f768e53cd8e20fa5e24a096b9a443940d8968cf1
Author: ahaas <ahaas@chromium.org>
Date: Wed May 25 09:26:28 2016

[wasm] Do not try start linking if the compilation failed.

BUG= chromium:614291 
LOG=N
R=titzer@chromium.org, bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2009823002
Cr-Commit-Position: refs/heads/master@{#36503}

[modify] https://crrev.com/f768e53cd8e20fa5e24a096b9a443940d8968cf1/src/wasm/wasm-module.cc

Project Member

Comment 4 by ClusterFuzz, May 25 2016

ClusterFuzz has detected this issue as fixed in range 36514:36515.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5692828894363648

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  AllowHandleAllocation::IsAllowed() in src/heap/heap-inl.h
  
Regressed: V8: r36206:36207
Fixed: V8: r36514:36515

Minimized Testcase (0.36 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95-DnL4FBFMKrSH0xaXOE1Dyvh6BOVzqAuEl-0QaN904yjoBA6aH9UGUy9Y0V-ocZrAijAjXiIGoSYn3zyINq9FVcN5Epq137SvoAUF9PHFG1ngPVPC_Jz5bDJw0OMzKa9aSCY0ToqRwYJLZaQExJphEJE7Vw
function __f_55(expected, __f_70, __f_8) {
 Wasm.instantiateModuleFromAsm( __f_70.toString());
}
function __f_18() {
  "use asm";
  function __f_40(__v_22, __v_24) {
    __v_22 = __v_22|0;
    __v_24 = __v_24|0;
    var __v_23 = (__v_24 + 1)|0
    __v_26 = __v_22;
    var __v_26 = 3.0;
  }
  function __f_19() {
  }
  return {__f_19: __f_19};
}
__f_55(101,__f_18);


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Comment 5 by ahaas@chromium.org, May 27 2016

Status: Fixed (was: Assigned)
Project Member

Comment 6 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment