Ill in sandbox::ResourceLimits::AdjustCurrent |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6171607952523264 Fuzzer: ochang_domfuzzer Job Type: linux_asan_chrome_mp Platform Id: linux Crash Type: Ill Crash Address: 0x7fb653330e28 Crash State: sandbox::ResourceLimits::AdjustCurrent v8::internal::wasm::NewArrayBuffer v8::WebAssemblyMemory Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=495357:495412 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6171607952523264 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Aug 29 2017
This looks pretty similar to the issue in https://bugs.chromium.org/p/chromium/issues/detail?id=759533. The stack trace shows a crash in ValueOrDie in the safe math library. This means we got an overflow and the browser chose to safely crash instead, which is the expected behavior. I'm concerned about why we got the overflow in the first place though, so I will investigate further.
,
Aug 29 2017
The reason we were getting an overflow is that the limits had not been lowered from their initial maximum. The fix is to clamp the limit changes at rlim_max so that we will continue to work even when the limits have not been lowered. There is a fix out for review at https://chromium-review.googlesource.com/c/chromium/src/+/642350
,
Aug 30 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/5dae9bd9b52ae0c1ed31bf48b76535afc65e3b87 commit 5dae9bd9b52ae0c1ed31bf48b76535afc65e3b87 Author: Eric Holk <eholk@chromium.org> Date: Wed Aug 30 01:03:21 2017 Clamp resource limit adjustment to current hard limit Attempting to raise the soft limit was failing if the limit had not previously been lowered. This change clamps the new limit to rlim_max, which means it will continue to work even if the resource limit is at its maximum. Bug: chromium:760051 Change-Id: Ia57a6dcdb1e28ffe12c3883f91a9427339d63be2 Reviewed-on: https://chromium-review.googlesource.com/642350 Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org> Commit-Queue: Eric Holk <eholk@chromium.org> Cr-Commit-Position: refs/heads/master@{#498323} [modify] https://crrev.com/5dae9bd9b52ae0c1ed31bf48b76535afc65e3b87/sandbox/linux/services/resource_limits.cc [modify] https://crrev.com/5dae9bd9b52ae0c1ed31bf48b76535afc65e3b87/sandbox/linux/services/resource_limits.h
,
Aug 30 2017
ClusterFuzz has detected this issue as fixed in range 498140:498364. Detailed report: https://clusterfuzz.com/testcase?key=6171607952523264 Fuzzer: ochang_domfuzzer Job Type: linux_asan_chrome_mp Platform Id: linux Crash Type: Ill Crash Address: 0x7fb653330e28 Crash State: sandbox::ResourceLimits::AdjustCurrent v8::internal::wasm::NewArrayBuffer v8::WebAssemblyMemory Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=495357:495412 Fixed: https://clusterfuzz.com/revisions?job=linux_asan_chrome_mp&range=498140:498364 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6171607952523264 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Aug 30 2017
ClusterFuzz testcase 6171607952523264 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||
►
Sign in to add a comment |
|||
Comment 1 by msrchandra@chromium.org
, Aug 29 2017Components: Internals>Core
Labels: Test-Predator-Wrong-CLs M-62
Owner: eholk@chromium.org
Status: Assigned (was: Untriaged)