New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 686612 link

Starred by 1 user
Status: Verified
Owner:
█ bradnelson@chromium.org
Last visit > 30 days ago
Closed: Mar 2017
Cc:
titzer@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

<no crash state available>

Project Member Reported by ClusterFuzz, Jan 30 2017 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4582491135672320

Fuzzer: mbarbella_js_mutation
Job Type: linux_msan_d8
Platform Id: linux

Crash Type: Fatal error
Crash Address: 
Crash State:
  NULL
Sanitizer: memory (MSAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_d8&range=435209:435314

Minimized Testcase (0.22 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv966icL2jwABDQAt6YhHJKclM6vyIaD43YNFTFs89mp5VPODdQggt9Ig67-E_ZPF6KFZYRUdmCnvKkXPnD331MNmX-JvBOGj8RToiUDQbdHsIfjFO3h8mQOMU_YqZw1C1C3YTSuB2o606mtgyutAU4HkLxR7JlmtlBRvbF5qjkO2rdzAilnKcCZwP1ktiFsqKgwZ0-NFsm0MeeqpSl8L9w8bj9CXF1tkYPv-eJx41la6CwWtc1XGSkidwU7uVB_o3HS4_6bxAxwY3zOgGqEmW3Q4IWFFBu8sz3f3gNA9N36jYXbTgtsvhqaqfyLMWK7f5Ppp6Aam1iUSYdXVxqA94VleGW50xl4SbcMpRVDPiQR57rCDfzg?testcase_id=4582491135672320
function module(stdlib, foreign, heap) {
    "use asm";
    var __v_0 = new stdlib.Int32Array(heap);
    function __f_0(i) {
      i = i|0;
      __v_0;
    }
}
var __f_0 = module().__f_0;
( {
})();
(function __f_38() {
})();


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by mstarzinger@chromium.org, Jan 30 2017

Cc: titzer@chromium.org
Owner: bradnelson@chromium.org
Status: Assigned (was: Untriaged)
Related to asm2wasm translation. The following is the assertion I get on tip-of-tree:

#
# Fatal error in ../src/asmjs/asm-wasm-builder.cc, line 652
# Check failed: kWasmStmt != var_type (kMachNone vs. kMachNone).
#
Project Member

Comment 3 by ClusterFuzz, Mar 6 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 4582491135672320 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
►

Sign in to add a comment