Out-of-memory in v8_wasm_async_fuzzer |
||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5161956230299648 Fuzzer: libFuzzer_v8_wasm_async_fuzzer Job Type: libfuzzer_chrome_msan Platform Id: linux Crash Type: Out-of-memory (exceeds 2048 MB) Crash Address: Crash State: v8_wasm_async_fuzzer Sanitizer: memory (MSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=510931:510956 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5161956230299648 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Nov 2 2017
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/793c52ed26daa002ba81a0bb4c20d809d0e33592 commit 793c52ed26daa002ba81a0bb4c20d809d0e33592 Author: Andreas Haas <ahaas@chromium.org> Date: Thu Nov 02 10:10:27 2017 [wasm] Improve stack check in the interpreter The existing stack check only checked the number of stack frames on the stack, not the actual size of the stack frames. In the test case, each stack frame is huge, and the interpreter runs out of memory before the stack check stops the execution. With this change we take the size of the value stack and the size of the control stack and compare their sum to the stack limit of V8. Note that this stack limit is kind of arbitrary, because the stack space of the interpreter is not on the actual runtime stack but allocated in zone memory, and the stack check exists to simulate stack overflows in compiled code, not to prevent actual stack overflows. R=clemensh@chromium.org TEST=mjsunit/regress/wasm/regress-778917 Bug: chromium:778917 Change-Id: Ife47631fcb1a178a68facab1e42c0069b12c0155 Reviewed-on: https://chromium-review.googlesource.com/744003 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#49071} [modify] https://crrev.com/793c52ed26daa002ba81a0bb4c20d809d0e33592/src/wasm/wasm-interpreter.cc [modify] https://crrev.com/793c52ed26daa002ba81a0bb4c20d809d0e33592/src/wasm/wasm-limits.h [add] https://crrev.com/793c52ed26daa002ba81a0bb4c20d809d0e33592/test/mjsunit/regress/wasm/regress-778917.js
,
Nov 12 2017
ClusterFuzz testcase 5161956230299648 is flaky and no longer crashes, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||
►
Sign in to add a comment |
||
Comment 1 by pnangunoori@chromium.org
, Oct 27 2017Components: Blink>JavaScript>WebAssembly
Labels: M-64 Test-Predator-Wrong
Owner: ahaas@chromium.org
Status: Assigned (was: Untriaged)