Out-of-memory in v8_wasm_code_fuzzer |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5683371572461568 Fuzzer: libFuzzer_v8_wasm_code_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Out-of-memory (exceeds 2048 MB) Crash Address: Crash State: v8_wasm_code_fuzzer Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=497803:497860 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5683371572461568 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Aug 29 2017
,
Aug 29 2017
After discussion with Andreas this seems to be related to my change where I removed the "maximum memory size" from the WasmModuleBuilder, not realizing that the fuzzer also uses the module builder. Will cook up a fix. Thanks Andreas, good catch!
,
Aug 29 2017
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/94b521126b869ddfec755c79f4edbd845c368c21 commit 94b521126b869ddfec755c79f4edbd845c368c21 Author: Michael Starzinger <mstarzinger@chromium.org> Date: Tue Aug 29 11:33:07 2017 [wasm] Support max memory size in WasmModuleBuilder. This adds support to specify the maximum memory size when building a WebAssembly module. Default is not maximum, one can be explicitly set. It is mainly used by the WebAssembly fuzzers to prevent OOMs. R=ahaas@chromium.org BUG= chromium:759973 Change-Id: Ibf5fa63a7e36e5f3b65ced528c73a65355d5632f Reviewed-on: https://chromium-review.googlesource.com/640386 Reviewed-by: Andreas Haas <ahaas@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#47676} [modify] https://crrev.com/94b521126b869ddfec755c79f4edbd845c368c21/src/wasm/wasm-module-builder.cc [modify] https://crrev.com/94b521126b869ddfec755c79f4edbd845c368c21/src/wasm/wasm-module-builder.h [modify] https://crrev.com/94b521126b869ddfec755c79f4edbd845c368c21/test/fuzzer/wasm-call.cc [modify] https://crrev.com/94b521126b869ddfec755c79f4edbd845c368c21/test/fuzzer/wasm-code.cc [modify] https://crrev.com/94b521126b869ddfec755c79f4edbd845c368c21/test/fuzzer/wasm-compile.cc
,
Aug 29 2017
Should be fixed by change in comment #4, leaving issue open and waiting for ClusterFuzz to confirm though.
,
Aug 30 2017
ClusterFuzz has detected this issue as fixed in range 498116:498178. Detailed report: https://clusterfuzz.com/testcase?key=5683371572461568 Fuzzer: libFuzzer_v8_wasm_code_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Out-of-memory (exceeds 2048 MB) Crash Address: Crash State: v8_wasm_code_fuzzer Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=497803:497860 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=498116:498178 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5683371572461568 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Aug 30 2017
Yep, fixed.
,
Aug 30 2017
ClusterFuzz testcase 5683371572461568 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by msrchandra@chromium.org
, Aug 29 2017Labels: Test-Predator-Wrong-CLs M-62