Null-dereference READ in multi-return.cc |
|||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4693221347950592 Fuzzer: libFuzzer_v8_multi_return_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x0000000000af Crash State: multi-return.cc Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=574001:574025 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4693221347950592 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Jul 11
Automatically adding ccs based on suspected regression changelists: [explicit isolates] Remove some GetHeaps from objects.cc by delphick@chromium.org - https://chromium.googlesource.com/v8/v8/+/f8bda2d359483176b0812ce4505eb53c77e9dd5d Version 6.9.341 by v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com - https://chromium.googlesource.com/v8/v8/+/1fb731225dcf4c3c4ae48cd9de167fbbfb76931e Disable a flaky test262 test by mslekova@chromium.org - https://chromium.googlesource.com/v8/v8/+/679a759e416642ee98b626ff9cd55bca3f551d99 If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
,
Jul 11
I suspect this is me since the other changes seem to be trivial.
,
Jul 11
The actual cause is https://chromium.googlesource.com/v8/v8/+/4c4c3437e07e67313fbe158fb1b71636f3174dc0
,
Jul 13
Can reproduces, I have a suspicion what's going on here, seems to be a problem with the fuzzer itself calling the WasmCode without a proper WasmInstanceObject.
,
Jul 13
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/44483870dcc75917e7f3cc56b371a73aaf43b0d1 commit 44483870dcc75917e7f3cc56b371a73aaf43b0d1 Author: Michael Starzinger <mstarzinger@chromium.org> Date: Fri Jul 13 12:09:24 2018 [fuzzer] Switch code kind for multi-return fuzzer. The code under test is handling of multi-return values in TurboFan and hence actually independent of WebAssembly. The only reason to generate WasmCode is in order to use the WebAseembly linkages. This changes the generated code to have {STUB} kind instead of {WASM_FUNCTION} kind to avoid having stack checks in the generated code which would require a proper WasmInstanceObject to be allocated. R=ahaas@chromium.org BUG= chromium:862508 Change-Id: I4feb7bff1a42bbf59cfc5f249f2e0585ce7011ad Reviewed-on: https://chromium-review.googlesource.com/1136438 Reviewed-by: Andreas Haas <ahaas@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#54436} [modify] https://crrev.com/44483870dcc75917e7f3cc56b371a73aaf43b0d1/test/fuzzer/multi-return.cc
,
Jul 13
,
Jul 17
ClusterFuzz has detected this issue as fixed in range 575209:575212. Detailed report: https://clusterfuzz.com/testcase?key=4693221347950592 Fuzzer: libFuzzer_v8_multi_return_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x0000000000af Crash State: multi-return.cc Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=574001:574025 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=575209:575212 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4693221347950592 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jul 17
ClusterFuzz testcase 4693221347950592 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by ClusterFuzz
, Jul 11Labels: Test-Predator-Auto-Components