New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 854011 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jul 3
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Ill in v8::internal::wasm::fuzzer::WasmExecutionFuzzer::FuzzWasmModule

Project Member Reported by ClusterFuzz, Jun 19 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5193823391842304

Fuzzer: libFuzzer_v8_wasm_compile_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Ill
Crash Address: 0x000002da2060
Crash State:
  v8::internal::wasm::fuzzer::WasmExecutionFuzzer::FuzzWasmModule
  wasm-compile.cc
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=562634:562654

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5193823391842304

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jun 19 2018

Components: Blink>JavaScript
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jun 19 2018

Cc: j...@ca.ibm.com szuend@google.com
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

PPC/s390: [stubs] Route all ArrayConstructor stub accesses through CodeFactory by jyan@ca.ibm.com - https://chromium.googlesource.com/v8/v8/+/d483edb5dd1823000071f33620d2b59293792855

[vscode-torque] Add vscode extension with basic Torque support. by szuend@google.com - https://chromium.googlesource.com/v8/v8/+/7975b8cef94966e5240b3d8a788688b181a06496

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Components: -Blink>JavaScript Blink>JavaScript>WebAssembly
Owner: clemensh@chromium.org
Status: Assigned (was: Untriaged)
Project Member

Comment 4 by bugdroid1@chromium.org, Jul 3

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/ed64d25febe406f667f3c2c0de1a2df294578313

commit ed64d25febe406f667f3c2c0de1a2df294578313
Author: Clemens Hammacher <clemensh@chromium.org>
Date: Tue Jul 03 07:01:14 2018

[Liftoff][arm64] Fix i32.popcnt

Only use the "W" part (lower 32 bit) of the src register. Otherwise, we
can get results larger than 32.

R=ahaas@chromium.org
CC=​rodolph.perfetta@arm.com

Bug:  v8:7914 ,  chromium:854011 
Change-Id: I6329231e6cc0ae537c165b2d383fc5a14bd28ca3
Reviewed-on: https://chromium-review.googlesource.com/1122409
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54152}
[modify] https://crrev.com/ed64d25febe406f667f3c2c0de1a2df294578313/src/wasm/baseline/arm64/liftoff-assembler-arm64.h

Project Member

Comment 5 by bugdroid1@chromium.org, Jul 3

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/2bc78a1c9ea5916a52061d1db03e24bb240cddae

commit 2bc78a1c9ea5916a52061d1db03e24bb240cddae
Author: Clemens Hammacher <clemensh@chromium.org>
Date: Tue Jul 03 11:55:34 2018

[wasm][fuzzer] Improve error output for exception mismatch

The current output of release builds is not very helpful, as it does
not contain the line number, nor the values of {expect_exception} or
{i_isolate->has_pending_exception()}.

R=ahaas@chromium.org

Bug:  chromium:854011 
Change-Id: I0bc1b8be6151d5420310eb67b2ebd0dc866fc9a6
Reviewed-on: https://chromium-review.googlesource.com/1122869
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54164}
[modify] https://crrev.com/2bc78a1c9ea5916a52061d1db03e24bb240cddae/test/fuzzer/wasm-fuzzer-common.cc

Project Member

Comment 6 by bugdroid1@chromium.org, Jul 3

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/720218c2a8aa1f322c1d5ace88bab48cc544ee34

commit 720218c2a8aa1f322c1d5ace88bab48cc544ee34
Author: Clemens Hammacher <clemensh@chromium.org>
Date: Tue Jul 03 17:04:49 2018

[Liftoff][arm64] Fix i64 constants passed via stack

We need to push the sign-extended constant instead of just the lower 32
bits. Otherwise, the callee might read stale data from the stack.

Bug:  chromium:854011 , v8:6600

R=ahaas@chromium.org
CC=rodolph.perfetta@arm.com

Change-Id: Iafcfd6ba9532771615b41215fb4d1a2b85ce5623
Reviewed-on: https://chromium-review.googlesource.com/1124683
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54185}
[modify] https://crrev.com/720218c2a8aa1f322c1d5ace88bab48cc544ee34/src/wasm/baseline/arm64/liftoff-assembler-arm64.h
[add] https://crrev.com/720218c2a8aa1f322c1d5ace88bab48cc544ee34/test/mjsunit/regress/wasm/regress-854011.js

Project Member

Comment 7 by bugdroid1@chromium.org, Jul 3

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/6406b6610cd74319c385cf4d6bc07fcc5dea5e06

commit 6406b6610cd74319c385cf4d6bc07fcc5dea5e06
Author: Clemens Hammacher <clemensh@chromium.org>
Date: Tue Jul 03 17:07:14 2018

[Liftoff][arm64] Use wzr/xzr for pushing zero constants

This is an optimization to avoid an unneeded "mov <reg>, #0"
instruction. Instead, we can just directly use the zero register.

R=ahaas@chromium.org

Bug:  chromium:854011 , v8:6600
Change-Id: I187d7a659c42d7d4a6d5798eddff8b7ee0983bbc
Reviewed-on: https://chromium-review.googlesource.com/1124684
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54186}
[modify] https://crrev.com/6406b6610cd74319c385cf4d6bc07fcc5dea5e06/src/wasm/baseline/arm64/liftoff-assembler-arm64.h

Status: Fixed (was: Assigned)
Project Member

Comment 9 by ClusterFuzz, Jul 7

ClusterFuzz has detected this issue as fixed in range 572608:573019.

Detailed report: https://clusterfuzz.com/testcase?key=5193823391842304

Fuzzer: libFuzzer_v8_wasm_compile_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Ill
Crash Address: 0x000002da2060
Crash State:
  v8::internal::wasm::fuzzer::WasmExecutionFuzzer::FuzzWasmModule
  wasm-compile.cc
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=562634:562654
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=572608:573019

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5193823391842304

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 10 by ClusterFuzz, Jul 7

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 5193823391842304 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment