Disposing the isolate that is entered by a thread in wasm-code.cc |
|||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5845846303440896 Fuzzer: libfuzzer_v8_wasm_code_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: Disposing the isolate that is entered by a thread in wasm-code.cc Sanitizer: undefined (UBSAN) Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=427885:428085 Minimized Testcase (0.01 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94R0Ahom040mGvGcdGdr7UkCGuvqd2ys50TPoErQY6PDCplBMJVPBmy_icgY11dla8sz0Lex_2xYqHVJN5BMJJMi0Ki_JVONhRNTIXQZ9KVEPysZi0YRUxfHZU9nh-qBLWmZfvCnfUNI7Z6_COndgdXFHabiNJQV802-04Jn07b32kYTxc7USJ_26eJ3zhe_6_k8QAb4l9KW0dzNPFp7WwpltWxID7CuIvEohkl0PTXundH3iucfAglwCjowR5aSbdUvBzoi8X4iaj2afkUZ4odg8lpyB7poHgNh-p2Ugquk3dFjICZAUQ7kcFuNHyej9fCVCAWkqu4VA_tDdUsAkcJOWZkymEjSUoIVMVG2zgTlgTl4I8?testcase_id=5845846303440896 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Feb 1 2017
This issue is a bug in the fuzzer, not a bug in the tested code. The fuzzer compares the output of the wasm interpreter with the output of the compiled wasm code. In the testcase, a calculation results in a non-deterministic NaN bit pattern (i.e. the bit pattern is different in interpreted code than in the compiled code), which is then observed by a reinterpret cast to int. In other words, the wasm spec allows non-deterministic results for the test case, and there the results of both the wasm interpreter and the wasm compiled code are correct although they are different. I have to change the fuzzer so that the results are not compared in this case.
,
Feb 7 2017
ClusterFuzz has detected this issue as fixed in range 448235:448242. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5845846303440896 Fuzzer: libfuzzer_v8_wasm_code_fuzzer Job Type: libfuzzer_chrome_ubsan Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: Disposing the isolate that is entered by a thread in wasm-code.cc Sanitizer: undefined (UBSAN) Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=427885:428085 Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=448235:448242 Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97pvQzYgXSZdWVmTyqcueoFPMPcAoKTbCFh5CrcBibIjUOce2GIJIuhjqgj6eVHjCLlwxkxlEmdjlSQ8Kl1q5DN0jC_U2aZupeFE_Ru5NZfFNbdvUhiPiIPDojPIFIiz-RxJFndXRWM3Y-VKBpUhVxMvBEzr5nxPvj7ogrNKcIjZ9ivg5Ufu82h0Rrx6AjJpL2HJREVqUEjaE6ofuI0wTCYLX1o5dYpYkOaHcuXTc3_kUOw2LpbqhldlOZk76PjgHIWiVTXOG4bxIA-lNsA2fUmX4M1vTtBqzbzr9SujvxevTLXGWXJrHtGJuwpYUEvVMFLS4AQHnsoD8Kz_JH3YyLY8nWCx8LuTj_vR424k4tCBV_rI-o?testcase_id=5845846303440896 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Feb 7 2017
ClusterFuzz testcase 5845846303440896 is verified as fixed, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||
►
Sign in to add a comment |
|||
Comment 1 by msrchandra@chromium.org
, Jan 18 2017Labels: Test-Predator-Wrong
Owner: ahaas@chromium.org
Status: Assigned (was: Untriaged)