New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 778917 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Closed: Nov 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Out-of-memory in v8_wasm_async_fuzzer

Project Member Reported by ClusterFuzz, Oct 27 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5161956230299648

Fuzzer: libFuzzer_v8_wasm_async_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Out-of-memory (exceeds 2048 MB)
Crash Address: 
Crash State:
  v8_wasm_async_fuzzer
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=510931:510956

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5161956230299648

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Cc: msrchandra@chromium.org pnangunoori@chromium.org
Components: Blink>JavaScript>WebAssembly
Labels: M-64 Test-Predator-Wrong
Owner: ahaas@chromium.org
Status: Assigned (was: Untriaged)
As per the  Issue 772751  owner, assigning this issue to @ahaas.
@ahaas -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes.
Thanks.
Project Member

Comment 2 by bugdroid1@chromium.org, Nov 2 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/793c52ed26daa002ba81a0bb4c20d809d0e33592

commit 793c52ed26daa002ba81a0bb4c20d809d0e33592
Author: Andreas Haas <ahaas@chromium.org>
Date: Thu Nov 02 10:10:27 2017

[wasm] Improve stack check in the interpreter

The existing stack check only checked the number of stack frames on the
stack, not the actual size of the stack frames. In the test case, each
stack frame is huge, and the interpreter runs out of memory before the
stack check stops the execution. With this change we take the size of
the value stack and the size of the control stack and compare their sum
to the stack limit of V8. Note that this stack limit is kind of
arbitrary, because the stack space of the interpreter is not on the
actual runtime stack but allocated in zone memory, and the stack check
exists to simulate stack overflows in compiled code, not to prevent
actual stack overflows.

R=clemensh@chromium.org
TEST=mjsunit/regress/wasm/regress-778917

Bug:  chromium:778917 
Change-Id: Ife47631fcb1a178a68facab1e42c0069b12c0155
Reviewed-on: https://chromium-review.googlesource.com/744003
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49071}
[modify] https://crrev.com/793c52ed26daa002ba81a0bb4c20d809d0e33592/src/wasm/wasm-interpreter.cc
[modify] https://crrev.com/793c52ed26daa002ba81a0bb4c20d809d0e33592/src/wasm/wasm-limits.h
[add] https://crrev.com/793c52ed26daa002ba81a0bb4c20d809d0e33592/test/mjsunit/regress/wasm/regress-778917.js

Project Member

Comment 3 by ClusterFuzz, Nov 12 2017

Status: WontFix (was: Assigned)
ClusterFuzz testcase 5161956230299648 is flaky and no longer crashes, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment