Null-dereference READ in v8::internal::wasm::NativeModule::GetCode |
||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5858270798675968 Fuzzer: ochang_js_fuzzer Job Type: linux_asan_d8_dbg Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: v8::internal::wasm::NativeModule::GetCode v8::internal::wasm::NativeModuleSerializer::BufferCurrentWasmCode v8::internal::wasm::NativeModuleSerializer::Write Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=49947:49948 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5858270798675968 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Jan 13 2018
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/f2e19a63873a700e6c0a1bca35e8301bd50db4e1 ([wasm] Add --wasm-jit-to-native under --future). If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
,
Jan 14 2018
,
Jan 15 2018
Reproduces nicely, I'll work on a fix.
,
Jan 15 2018
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/0465c7607a2fdd1e72df02faa4403f4b680e008e commit 0465c7607a2fdd1e72df02faa4403f4b680e008e Author: Michael Starzinger <mstarzinger@chromium.org> Date: Mon Jan 15 14:25:18 2018 [wasm] Fix serialization of empty modules. This fixes a corner-case in the {NativeModuleSerializer} with modules that do not contain any functions in the code table. R=ahaas@chromium.org TEST=mjsunit/regress/wasm/regress-801850 BUG= chromium:801850 Change-Id: I30cc3a26f30d8653fba2d7b99715830d12300ac2 Reviewed-on: https://chromium-review.googlesource.com/866773 Reviewed-by: Andreas Haas <ahaas@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#50581} [modify] https://crrev.com/0465c7607a2fdd1e72df02faa4403f4b680e008e/src/wasm/wasm-serialization.cc [add] https://crrev.com/0465c7607a2fdd1e72df02faa4403f4b680e008e/test/mjsunit/regress/wasm/regress-801850.js
,
Jan 15 2018
,
Jan 16 2018
ClusterFuzz has detected this issue as fixed in range 50580:50581. Detailed report: https://clusterfuzz.com/testcase?key=5858270798675968 Fuzzer: ochang_js_fuzzer Job Type: linux_asan_d8_dbg Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: v8::internal::wasm::NativeModule::GetCode v8::internal::wasm::NativeModuleSerializer::BufferCurrentWasmCode v8::internal::wasm::NativeModuleSerializer::Write Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=49947:49948 Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=50580:50581 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5858270798675968 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jan 16 2018
ClusterFuzz testcase 5858270798675968 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by ClusterFuzz
, Jan 13 2018Labels: Test-Predator-Auto-Components