New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 862508 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jul 13
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Null-dereference READ in multi-return.cc

Project Member Reported by ClusterFuzz, Jul 11

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4693221347950592

Fuzzer: libFuzzer_v8_multi_return_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x0000000000af
Crash State:
  multi-return.cc
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=574001:574025

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4693221347950592

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jul 11

Components: Blink>JavaScript
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jul 11

Cc: v8-ci-au...@chops-service-accounts.iam.gserviceaccount.com mslekova@chromium.org delph...@chromium.org
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

[explicit isolates] Remove some GetHeaps from objects.cc by delphick@chromium.org - https://chromium.googlesource.com/v8/v8/+/f8bda2d359483176b0812ce4505eb53c77e9dd5d

Version 6.9.341 by v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com - https://chromium.googlesource.com/v8/v8/+/1fb731225dcf4c3c4ae48cd9de167fbbfb76931e

Disable a flaky test262 test by mslekova@chromium.org - https://chromium.googlesource.com/v8/v8/+/679a759e416642ee98b626ff9cd55bca3f551d99

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Owner: delph...@chromium.org
Status: Started (was: Untriaged)
I suspect this is me since the other changes seem to be trivial.
Components: -Blink>JavaScript Blink>JavaScript>WebAssembly
Owner: mstarzinger@chromium.org
Status: Assigned (was: Started)
The actual cause is https://chromium.googlesource.com/v8/v8/+/4c4c3437e07e67313fbe158fb1b71636f3174dc0
Cc: ahaas@chromium.org
Labels: -Pri-1 Pri-2
Status: Started (was: Assigned)
Can reproduces, I have a suspicion what's going on here, seems to be a problem with the fuzzer itself calling the WasmCode without a proper WasmInstanceObject.
Project Member

Comment 6 by bugdroid1@chromium.org, Jul 13

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/44483870dcc75917e7f3cc56b371a73aaf43b0d1

commit 44483870dcc75917e7f3cc56b371a73aaf43b0d1
Author: Michael Starzinger <mstarzinger@chromium.org>
Date: Fri Jul 13 12:09:24 2018

[fuzzer] Switch code kind for multi-return fuzzer.

The code under test is handling of multi-return values in TurboFan and
hence actually independent of WebAssembly. The only reason to generate
WasmCode is in order to use the WebAseembly linkages. This changes the
generated code to have {STUB} kind instead of {WASM_FUNCTION} kind to
avoid having stack checks in the generated code which would require a
proper WasmInstanceObject to be allocated.

R=ahaas@chromium.org
BUG= chromium:862508 

Change-Id: I4feb7bff1a42bbf59cfc5f249f2e0585ce7011ad
Reviewed-on: https://chromium-review.googlesource.com/1136438
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54436}
[modify] https://crrev.com/44483870dcc75917e7f3cc56b371a73aaf43b0d1/test/fuzzer/multi-return.cc

Status: Fixed (was: Started)
Project Member

Comment 8 by ClusterFuzz, Jul 17

ClusterFuzz has detected this issue as fixed in range 575209:575212.

Detailed report: https://clusterfuzz.com/testcase?key=4693221347950592

Fuzzer: libFuzzer_v8_multi_return_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x0000000000af
Crash State:
  multi-return.cc
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=574001:574025
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=575209:575212

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4693221347950592

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Jul 17

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 4693221347950592 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment