New issue
Advanced search Search tips

Issue 709174 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Apr 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Indirect-leak in v8::internal::AccountingAllocator::AllocateSegment

Project Member Reported by ClusterFuzz, Apr 6 2017

Issue description

Components: Blink>JavaScript
Labels: M-59 Test-Predator-Correct-CLs
Owner: ahaas@chromium.org
Status: Assigned (was: Untriaged)
The result is a list of CLs that change the crashed files. 

Author: Andreas Haas
Project: chromium-v8
Changelist: https://chromium.googlesource.com/v8/v8.git/+/22615158ed2f522c75c75bca85e1afc62ccd21ee
Time: Thu Apr 06 09:49:38 2017
Lines 3935-3944 of file wasm-compiler.cc which potentially caused crash are changed in this cl (frame #7, "v8::internal::compiler::WasmCompilationUnit::WasmCompilationUnit").
Minimum distance from crash line to modified line: 0. (file: wasm-compiler.cc, crashed on: 3935, modified: 3935).
Project Member

Comment 2 by bugdroid1@chromium.org, Apr 7 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/5824c72dd86a54dfa9c981bff5fd018b319f5d4f

commit 5824c72dd86a54dfa9c981bff5fd018b319f5d4f
Author: Andreas Haas <ahaas@chromium.org>
Date: Fri Apr 07 08:01:55 2017

[wasm] Delete all compilation units even after compilation errors

FinishCompilationUnits used the assumption that FinishCompilationUnit
only return null if there is no compilation unit left to be finished.
This assumption was wrong though, because also a compilation error can
cause the result to be null. Therefore I switched to use the function
index as a new indicator.

BUG= chromium:709174 

Change-Id: I3e9689fd71b8364422e1c74404921df2799191aa
Reviewed-on: https://chromium-review.googlesource.com/471347
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44468}
[modify] https://crrev.com/5824c72dd86a54dfa9c981bff5fd018b319f5d4f/src/wasm/wasm-module.cc

Project Member

Comment 3 by ClusterFuzz, Apr 7 2017

ClusterFuzz has detected this issue as fixed in range 462459:462500.

Detailed report: https://clusterfuzz.com/testcase?key=6277403837202432

Fuzzer: libfuzzer_v8_wasm_asmjs_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Indirect-leak
Crash Address: 
Crash State:
  v8::internal::AccountingAllocator::AllocateSegment
  v8::internal::AccountingAllocator::GetSegment
  v8::internal::Zone::NewSegment
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=462439:462459
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=462459:462500

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv96S6hgXRLMEgESyduFB7eWhdkMld3ZWIysBg9GN2S8kNfajTUE22oEpc2y5kyIarFQp9x3l_RzY7g4iQ308KLw2XSPYUQqy-A-UCNEB4ycqIPdVuu-EYbkFFit6Mc5CdlSyE-pS4bn_h5_XDLZG3hiBkZhx4ztNxSggAlBnWPIXdF25aS43qUwD8uNESGCGYciK96o-5ws0rg08IBY49H_8RrgsUHfK28qEoUQCdI3XkPvJP8KsdH4M1dl-QgM6G0qcb7ttTJ1wnSMfPIqfY1bCnl_5gMxylC-WkpAEoPeKIYz7F1TYFgjP_4yIPQXZkalxkFCqW_Js49jH0mN7CvvlCXjYtyXOsBPAyVriOd35g2AB9Bk?testcase_id=6277403837202432


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 4 by ClusterFuzz, Apr 7 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6277403837202432 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment