Hi Tobias,

Assigning to you based on https://chromium.googlesource.com/v8/v8/+/c3a6ca68d0646b10885ef7017557eaf463db2e4a

Feel free to re-assign as appropriate!

Thanks.

This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

GetPositionInfo() seems to blow up when accessing the (not undefined) line_ends of a Script object corresponding to an AsmJsWasmStackFrame. Seems to be the fault of an odd Script object from the Wasm pipeline.

I am pretty sure that this is a duplicate of 677685.

It accesses the asm.js source position table out of bounds (because the table is empty). It expectes to find a mapping for position 0, reported from the top stack frame on a stack check failure.

Let's see if Clusterfuzz reports this as fixed when I land the other CL.

ClusterFuzz has detected this issue as fixed in range 441524:442831.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6618801555898368

Fuzzer: mbarbella_js_mutation
Job Type: linux_msan_d8
Platform Id: linux

Crash Type: Use-of-uninitialized-value
Crash Address: 
Crash State:
  v8::internal::Script::GetPositionInfo
  v8::internal::Script::GetLineNumber
  v8::internal::AsmJsWasmStackFrame::GetLineNumber
  
Sanitizer: memory (MSAN)

Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_d8&range=440059:440074
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_d8&range=441524:442831

Minimized Testcase (0.58 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96LYzku03ufU0IOnzZKDajDXRRUv1Z0fT-zOY6cUtORC4LBpbJUtiOXG-RhxljZZzdw2KUVq8ZkerfWsrNFcSzgxhNAI6zeQ4YY5YsL8k_6S-14OU0VQ3-iP0rixqTZnfml8viS6BPI9Kso7VVIf3uCr1zDgQ?testcase_id=6618801555898368

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot