Fatal error in |
||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5701272523767808 Fuzzer: ochang_js_fuzzer_win Job Type: windows_asan_d8 Platform Id: windows Crash Type: Fatal error Crash Address: Crash State: v8::platform::PrintStackTrace v8::internal::Runtime_DeserializeWasmModule v8::internal::DefaultEmbeddedBlobSize Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=windows_asan_d8&range=51276:51277 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5701272523767808 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
May 23 2018
Clusterfuzz seems to be keen on circumventing our builtins whitelisting:
let __v_39146 = `onmessage = function(msg) {
let {serialized_m1, m1_bytes} = msg;
let m1_clone = %DeserializeWasmModule(serialized_m1, m1_bytes);
}`;
let __v_39147 = new Worker(__v_39146);
__v_39147.postMessage({
});
,
May 30 2018
ClusterFuzz testcase 5701272523767808 is still reproducing on tip-of-tree build (trunk). If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase. Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace.
,
Aug 17
Issue 873601 has been merged into this issue.
,
Aug 17
This crash occurs very frequently on android and windows platforms and is likely preventing the fuzzer ochang_js_fuzzer_win from making much progress. Fixing this will allow more bugs to be found. Marking this bug as a blocker for next Beta release. If this is incorrect, please add ClusterFuzz-Wrong label and remove the ReleaseBlock-Beta label.
,
Aug 17
,
Aug 17
|
||||||
►
Sign in to add a comment |
||||||
Comment 1 by ClusterFuzz
, May 18 2018Owner: cbruni@chromium.org
Status: Assigned (was: Untriaged)