Ill in v8::internal::wasm::fuzzer::WasmExecutionFuzzer::FuzzWasmModule |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5193823391842304 Fuzzer: libFuzzer_v8_wasm_compile_fuzzer Job Type: libfuzzer_chrome_msan Platform Id: linux Crash Type: Ill Crash Address: 0x000002da2060 Crash State: v8::internal::wasm::fuzzer::WasmExecutionFuzzer::FuzzWasmModule wasm-compile.cc Sanitizer: memory (MSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=562634:562654 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5193823391842304 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Jun 19 2018
Automatically adding ccs based on suspected regression changelists: PPC/s390: [stubs] Route all ArrayConstructor stub accesses through CodeFactory by jyan@ca.ibm.com - https://chromium.googlesource.com/v8/v8/+/d483edb5dd1823000071f33620d2b59293792855 [vscode-torque] Add vscode extension with basic Torque support. by szuend@google.com - https://chromium.googlesource.com/v8/v8/+/7975b8cef94966e5240b3d8a788688b181a06496 If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
,
Jun 20 2018
,
Jul 3
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/ed64d25febe406f667f3c2c0de1a2df294578313 commit ed64d25febe406f667f3c2c0de1a2df294578313 Author: Clemens Hammacher <clemensh@chromium.org> Date: Tue Jul 03 07:01:14 2018 [Liftoff][arm64] Fix i32.popcnt Only use the "W" part (lower 32 bit) of the src register. Otherwise, we can get results larger than 32. R=ahaas@chromium.org CC=rodolph.perfetta@arm.com Bug: v8:7914 , chromium:854011 Change-Id: I6329231e6cc0ae537c165b2d383fc5a14bd28ca3 Reviewed-on: https://chromium-review.googlesource.com/1122409 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#54152} [modify] https://crrev.com/ed64d25febe406f667f3c2c0de1a2df294578313/src/wasm/baseline/arm64/liftoff-assembler-arm64.h
,
Jul 3
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/2bc78a1c9ea5916a52061d1db03e24bb240cddae commit 2bc78a1c9ea5916a52061d1db03e24bb240cddae Author: Clemens Hammacher <clemensh@chromium.org> Date: Tue Jul 03 11:55:34 2018 [wasm][fuzzer] Improve error output for exception mismatch The current output of release builds is not very helpful, as it does not contain the line number, nor the values of {expect_exception} or {i_isolate->has_pending_exception()}. R=ahaas@chromium.org Bug: chromium:854011 Change-Id: I0bc1b8be6151d5420310eb67b2ebd0dc866fc9a6 Reviewed-on: https://chromium-review.googlesource.com/1122869 Reviewed-by: Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#54164} [modify] https://crrev.com/2bc78a1c9ea5916a52061d1db03e24bb240cddae/test/fuzzer/wasm-fuzzer-common.cc
,
Jul 3
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/720218c2a8aa1f322c1d5ace88bab48cc544ee34 commit 720218c2a8aa1f322c1d5ace88bab48cc544ee34 Author: Clemens Hammacher <clemensh@chromium.org> Date: Tue Jul 03 17:04:49 2018 [Liftoff][arm64] Fix i64 constants passed via stack We need to push the sign-extended constant instead of just the lower 32 bits. Otherwise, the callee might read stale data from the stack. Bug: chromium:854011 , v8:6600 R=ahaas@chromium.org CC=rodolph.perfetta@arm.com Change-Id: Iafcfd6ba9532771615b41215fb4d1a2b85ce5623 Reviewed-on: https://chromium-review.googlesource.com/1124683 Reviewed-by: Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#54185} [modify] https://crrev.com/720218c2a8aa1f322c1d5ace88bab48cc544ee34/src/wasm/baseline/arm64/liftoff-assembler-arm64.h [add] https://crrev.com/720218c2a8aa1f322c1d5ace88bab48cc544ee34/test/mjsunit/regress/wasm/regress-854011.js
,
Jul 3
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/6406b6610cd74319c385cf4d6bc07fcc5dea5e06 commit 6406b6610cd74319c385cf4d6bc07fcc5dea5e06 Author: Clemens Hammacher <clemensh@chromium.org> Date: Tue Jul 03 17:07:14 2018 [Liftoff][arm64] Use wzr/xzr for pushing zero constants This is an optimization to avoid an unneeded "mov <reg>, #0" instruction. Instead, we can just directly use the zero register. R=ahaas@chromium.org Bug: chromium:854011 , v8:6600 Change-Id: I187d7a659c42d7d4a6d5798eddff8b7ee0983bbc Reviewed-on: https://chromium-review.googlesource.com/1124684 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#54186} [modify] https://crrev.com/6406b6610cd74319c385cf4d6bc07fcc5dea5e06/src/wasm/baseline/arm64/liftoff-assembler-arm64.h
,
Jul 3
,
Jul 7
ClusterFuzz has detected this issue as fixed in range 572608:573019. Detailed report: https://clusterfuzz.com/testcase?key=5193823391842304 Fuzzer: libFuzzer_v8_wasm_compile_fuzzer Job Type: libfuzzer_chrome_msan Platform Id: linux Crash Type: Ill Crash Address: 0x000002da2060 Crash State: v8::internal::wasm::fuzzer::WasmExecutionFuzzer::FuzzWasmModule wasm-compile.cc Sanitizer: memory (MSAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=562634:562654 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=572608:573019 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5193823391842304 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jul 7
ClusterFuzz testcase 5193823391842304 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, Jun 19 2018Labels: Test-Predator-Auto-Components