Null-dereference WRITE in v8::internal::Invoke |
||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4544511232704512 Fuzzer: decoder_langfuzz Job Type: linux_asan_d8 Platform Id: linux Crash Type: Null-dereference WRITE Crash Address: 0x0000000000d0 Crash State: v8::internal::Invoke v8::internal::CallInternal v8::Script::Run Sanitizer: address (ASAN) Regressed: V8: 47228:47229 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4544511232704512 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Aug 10 2017
Detailed report: https://clusterfuzz.com/testcase?key=4750880317636608 Fuzzer: decoder_langfuzz Job Type: linux_asan_d8 Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: v8::internal::Invoke v8::internal::CallInternal v8::Script::Run Sanitizer: address (ASAN) Regressed: V8: 47228:47229 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4750880317636608 See https://github.com/google/clusterfuzz-tools for more information.
,
Aug 10 2017
Issue 754203 has been merged into this issue.
,
Aug 10 2017
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/1ca0eea23c876c16c3fa7484399e8884ee7001c6 commit 1ca0eea23c876c16c3fa7484399e8884ee7001c6 Author: Mircea Trofin <mtrofin@chromium.org> Date: Thu Aug 10 14:52:50 2017 [wasm] Correctly reconstitute ModuleEnv from runtime data When lazy-compiling, it is important we reconstitute the ModuleEnv accurately. Besides addressing a bug, this change also does away with the need to relocate memory and globals parameters (in lazy compilation), by using "the right ones" upfront. Bug: chromium:753496 Change-Id: I1412a499f05d02d49319fced1b3047698328f3b5 Reviewed-on: https://chromium-review.googlesource.com/609376 Reviewed-by: Brad Nelson <bradnelson@chromium.org> Commit-Queue: Brad Nelson <bradnelson@chromium.org> Cr-Commit-Position: refs/heads/master@{#47280} [modify] https://crrev.com/1ca0eea23c876c16c3fa7484399e8884ee7001c6/src/wasm/wasm-module.cc [add] https://crrev.com/1ca0eea23c876c16c3fa7484399e8884ee7001c6/test/mjsunit/regress/wasm/regression-753496.js
,
Aug 11 2017
ClusterFuzz has detected this issue as fixed in range 47279:47280. Detailed report: https://clusterfuzz.com/testcase?key=4750880317636608 Fuzzer: decoder_langfuzz Job Type: linux_asan_d8 Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: v8::internal::Invoke v8::internal::CallInternal v8::Script::Run Sanitizer: address (ASAN) Regressed: V8: 47228:47229 Fixed: V8: 47279:47280 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4750880317636608 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Aug 11 2017
ClusterFuzz has detected this issue as fixed in range 47279:47280. Detailed report: https://clusterfuzz.com/testcase?key=4544511232704512 Fuzzer: decoder_langfuzz Job Type: linux_asan_d8 Platform Id: linux Crash Type: Null-dereference WRITE Crash Address: 0x0000000000d0 Crash State: v8::internal::Invoke v8::internal::CallInternal v8::Script::Run Sanitizer: address (ASAN) Regressed: V8: 47228:47229 Fixed: V8: 47279:47280 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4544511232704512 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Aug 11 2017
ClusterFuzz testcase 4544511232704512 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||
►
Sign in to add a comment |
||
Comment 1 by mstarzinger@chromium.org
, Aug 9 2017Components: -Blink>JavaScript Blink>JavaScript>WebAssembly
Owner: mtrofin@chromium.org
Status: Assigned (was: Untriaged)