New issue
Advanced search Search tips

Issue 763696 link

Starred by 1 user
Status: Duplicate
Merged: issue 763349
Owner:
ahaas@chromium.org
Closed: Sep 2017
Cc:
clemensh@chromium.org
adamk@chromium.org
titzer@chromium.org
dschuff@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in v8::internal::MemoryChunk::heap

Project Member Reported by ClusterFuzz, Sep 10 2017 
Detailed report: https://clusterfuzz.com/testcase?key=4543901460594688

Fuzzer: libFuzzer_v8_wasm_async_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  v8::internal::MemoryChunk::heap
  v8::internal::HeapObject::GetIsolate
  v8::internal::WasmExportedFunction::function_index
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=500374:500444

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4543901460594688

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

Comment 1 by kkaluri@chromium.org, Sep 11 2017

Components: Blink>JavaScript
Labels: M-63 Test-Predator-Wrong-CLs

Comment 2 by mstarzinger@chromium.org, Sep 11 2017

Cc: clemensh@chromium.org
Components: -Blink>JavaScript Blink>JavaScript>WebAssembly
Owner: ahaas@chromium.org
Status: Assigned (was: Untriaged)
Most likely culprit is 7b53a0e010d0e53fbf59620423d8ae644335ae11. Didn't verify locally. Probably a dupe of  issue 763670 .

Comment 3 by ahaas@chromium.org, Sep 11 2017

Mergedinto: 763349
Status: Duplicate (was: Assigned)
Project Member

Comment 4 by ClusterFuzz, Sep 12 2017 

ClusterFuzz has detected this issue as fixed in range 500940:500995.

Detailed report: https://clusterfuzz.com/testcase?key=4543901460594688

Fuzzer: libFuzzer_v8_wasm_async_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  v8::internal::MemoryChunk::heap
  v8::internal::HeapObject::GetIsolate
  v8::internal::WasmExportedFunction::function_index
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=500374:500444
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=500940:500995

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4543901460594688

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
►

Sign in to add a comment