New issue
Advanced search Search tips

Issue 782267 link

Starred by 1 user

Issue metadata

Status: Fixed
Merged: issue 782280
Owner:
Closed: Nov 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security



Sign in to add a comment

DCHECK failure in !isolate_->has_pending_exception() in module-compiler.cc

Project Member Reported by ClusterFuzz, Nov 7 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5193231133573120

Fuzzer: libFuzzer_v8_wasm_call_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  !isolate_->has_pending_exception() in module-compiler.cc
  v8::internal::wasm::InstanceBuilder::Build
  SyncInstantiate
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=514360:514382

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5193231133573120

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Components: Blink>JavaScript
Project Member

Comment 2 by ClusterFuzz, Nov 7 2017

Components: Blink>JavaScript>WebAssembly
Labels: Test-Predator-AutoComponents
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Labels: Test-Predator-Auto-CC
Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components
Labels: -Test-Predator-Auto-CC
Cc: ahaas@chromium.org
Owner: clemensh@chromium.org
Status: Assigned (was: Untriaged)
clemensh: possibly due to https://chromium-review.googlesource.com/c/v8/v8/+/753727? Can you take a look?
Project Member

Comment 7 by sheriffbot@chromium.org, Nov 8 2017

Labels: M-64
Project Member

Comment 8 by sheriffbot@chromium.org, Nov 8 2017

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 9 by sheriffbot@chromium.org, Nov 8 2017

Labels: Pri-1
Mergedinto: 782280
Status: Duplicate (was: Assigned)
Cc: -ahaas@chromium.org clemensh@chromium.org
Owner: ahaas@chromium.org
Status: Started (was: Duplicate)
Sorry, no duplicate.

CL: https://chromium-review.googlesource.com/c/v8/v8/+/758272
Project Member

Comment 12 by bugdroid1@chromium.org, Nov 9 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/4a7c98e51ca5ce8d0d4504557bfe9ef47e19e068

commit 4a7c98e51ca5ce8d0d4504557bfe9ef47e19e068
Author: Andreas Haas <ahaas@chromium.org>
Date: Thu Nov 09 12:17:05 2017

[wasm][fuzzer] Clear pending exception unconditionally

Pending exceptions were not cleared when the TurboFan result was not
compared to the Interpreter result, which happens when the result may be
affected by potential nondeterminism. With this CL we always clear
pending exceptions.

R=clemensh@chromium.org

Bug:  chromium:782267 
Change-Id: Ibe9b33c94810cccb6282c6c8dc49748fb79b07e4
Reviewed-on: https://chromium-review.googlesource.com/758272
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49265}
[modify] https://crrev.com/4a7c98e51ca5ce8d0d4504557bfe9ef47e19e068/test/fuzzer/wasm-fuzzer-common.cc

Status: Fixed (was: Started)
Project Member

Comment 14 by sheriffbot@chromium.org, Nov 9 2017

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 15 by ClusterFuzz, Nov 10 2017

ClusterFuzz has detected this issue as fixed in range 515281:515308.

Detailed report: https://clusterfuzz.com/testcase?key=5193231133573120

Fuzzer: libFuzzer_v8_wasm_call_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  !isolate_->has_pending_exception() in module-compiler.cc
  v8::internal::wasm::InstanceBuilder::Build
  SyncInstantiate
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=514360:514382
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=515281:515308

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5193231133573120

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 16 by sheriffbot@chromium.org, Feb 15 2018

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 17 by sheriffbot@chromium.org, Mar 27 2018

Labels: -Security_Impact-Head -M-64 M-65 Security_Impact-Stable
Labels: -ReleaseBlock-Stable

Sign in to add a comment