Fatal error in v8::Isolate::Disposev8::Utils::ReportApiFailure |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4614355344949248 Fuzzer: libFuzzer_v8_wasm_asmjs_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Fatal error Crash Address: Crash State: v8::Isolate::Disposev8::Utils::ReportApiFailure v8::Utils::ApiCheck v8::Isolate::Dispose Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=478669:478745 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4614355344949248 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Jun 14 2017
This is caused by the v8_wasm_asmjs_fuzzer faking the WASM module to be derived from a JS-source. The module however does not have asm.js source position mapping. The same repro also fires a whole slew of DCHECKs throughout the system (e.g. the DCHECKs in WasmSharedModuleData::is_asm_js). I am not sure we actually should make all of this fail gracefully. This report is not a release blocker however, lowering priority.
,
Jun 16 2017
Need to discuss with WebAssembly folks next week. Probably gonna land on my plate.
,
Jun 19 2017
,
Jun 19 2017
,
Jun 21 2017
|
|||||
►
Sign in to add a comment |
|||||
Comment 1 by msrchandra@chromium.org
, Jun 13 2017Labels: Test-Predator-Wrong-CLs M-61