Stack-overflow in Parser::ParseExpression |
||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6317492428079104 Fuzzer: libFuzzer_gn_parser_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Stack-overflow Crash Address: 0x7ffd77affcb8 Crash State: Parser::ParseExpression Parser::Assignment Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=532258:532261 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6317492428079104 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Jan 28 2018
Automatically applying components based on crash stacktrace and information from OWNERS files. If this is incorrect, please apply the Test-Predator-Wrong-Components label.
,
Jan 28 2018
Automatically adding ccs based on suspected regression changelists: Remove libunwind arm dependency from libc++abi (src-side changes) by thomasanderson@chromium.org - https://chromium.googlesource.com/chromium/src/+/ea4edeec4194c6e751d3be2d5fa262a2475f6c47 Remove usage of SequencedWorkerPoolOwner. by fdoray@chromium.org - https://chromium.googlesource.com/chromium/src/+/c3b4d56a01fb89d9b290214a36beb2f1eafa5c5b If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
,
Feb 5 2018
thomasanderson@/fdoray@ Could you please look into this issue.
,
Feb 5 2018
This is expected. Clusterfuzz is generating code like "T=T=T=T=T=...". Each "=" is another stack frame, so if you do that enough, eventually you'll run out of stack space.
,
Feb 5 2018
+pennymac - didn't we do something that was supposed to prevent the fuzzers from going down this path?
,
Feb 6 2018
https://bugs.chromium.org/p/chromium/issues/detail?id=780844 Just for reference. If a new "open ended", repeating token is found by the fuzzer (by running out of memory), it can quickly be added to the sanity check code as seen here. There shouldn't be many more missed! :)
,
Feb 12 2018
ClusterFuzz testcase 6317492428079104 is still reproducing on tip-of-tree build (trunk). If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase. Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace. |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by ClusterFuzz
, Jan 28 2018