New issue
Advanced search Search tips

Issue 812358 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 2
Type: Bug



Sign in to add a comment

Timeout in v8_wasm_compile_fuzzer

Project Member Reported by ClusterFuzz, Feb 14 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5738896076570624

Fuzzer: libFuzzer_v8_wasm_compile_fuzzer
Job Type: mac_libfuzzer_chrome_asan
Platform Id: mac

Crash Type: Timeout (exceeds 25 secs)
Crash Address: 
Crash State:
  v8_wasm_compile_fuzzer
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=534019:534158

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5738896076570624

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Feb 14 2018

Components: Blink>JavaScript
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Feb 14 2018

Labels: Test-Predator-Auto-Owner
Owner: mstarzinger@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/338f39027505c352772bcd860c3f7836aa734b9f ([wasm] Make {JSPromise::Resolve} and friend MUST_USE_RESULT.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Cc: ahaas@chromium.org
Components: -Blink>JavaScript Blink>JavaScript>WebAssembly
Labels: Test-Predator-Wrong-CLs OS-iOS
Pretty sure it is not the CL suspected in comment #2.
Labels: -OS-iOS
Cc: -ahaas@chromium.org mstarzinger@chromium.org
Labels: -Pri-1 Pri-2
Owner: ahaas@chromium.org
Chances are this is non-actionable. Andreas agreed to take a brief look. Thanks!

Comment 6 by ahaas@chromium.org, Feb 15 2018

Cc: infe...@chromium.org
The problem seems to be that the generated function is just really really big.

inferno: the test case of this issue has 644 KB, but according to https://cs.chromium.org/chromium/src/testing/libfuzzer/fuzzers/BUILD.gn?l=250 the maximum length should be limited with 500 bytes. Is there a way to limit the size of a testcase?
Cc: och...@chromium.org kcc@chromium.org
Weird, max length is correctly set to 500

see avg_max_len graph on
https://clusterfuzz.com/v2/fuzzer-stats/by-time/2018-02-15/2018-02-21/fuzzer/libFuzzer_v8_wasm_compile_fuzzer

I still don't understand why we have >500 length items in corpus (https://pantheon.corp.google.com/storage/browser/clusterfuzz-corpus/libfuzzer/v8_wasm_compile_fuzzer), that could be the reason for this. kcc@, if max_len is set, does libFuzzer ignore corpus items that are bigger than max_len ?
Project Member

Comment 8 by ClusterFuzz, Apr 26 2018

ClusterFuzz has detected this issue as fixed in range 553283:553465.

Detailed report: https://clusterfuzz.com/testcase?key=5738896076570624

Fuzzer: libFuzzer_v8_wasm_compile_fuzzer
Job Type: mac_libfuzzer_chrome_asan
Platform Id: mac

Crash Type: Timeout (exceeds 25 secs)
Crash Address: 
Crash State:
  v8_wasm_compile_fuzzer
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=534019:534158
Fixed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=553283:553465

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5738896076570624

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Apr 26 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5738896076570624 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment