Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/07aafb76f60326f5750787cf0e48e859d0eaa194 ([wasm] Fix missing cancellation of background compilation).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

clemensh: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/98bdaf9836d672434a3be288b4312d299f884c1e

commit 98bdaf9836d672434a3be288b4312d299f884c1e
Author: Clemens Hammacher <clemensh@chromium.org>
Date: Thu Sep 06 14:03:49 2018

[wasm] Fix worker termination while compiling

If a web worker terminates while a wasm finisher task is scheduled, we
try to cancel that task even though the platform already deleted it.
This results in UBSan failures, ASan failures or crashes.

This CL fixes this by deregistering the foreground task when it is
deleted before being executed.
A layout test for this will be added to chromium in
https://crrev.com/c/1209602.

R=ahaas@chromium.org

Bug:  chromium:875579 
Change-Id: Icae43a9dcc6dc16c872851961894bf8bc0872de8
Reviewed-on: https://chromium-review.googlesource.com/1209344
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55689}
[modify] https://crrev.com/98bdaf9836d672434a3be288b4312d299f884c1e/src/wasm/module-compiler.cc

ClusterFuzz has detected this issue as fixed in range 589344:589345.

Detailed report: https://clusterfuzz.com/testcase?key=6243582865047552

Fuzzer: inferno_twister
Job Type: linux_ubsan_vptr_content_shell_drt
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0x2d226ef32f80
Crash State:
  Bad-cast to v8::internal::wasm::AsyncCompileJob::CompileTask from invalid vptr
  v8::internal::wasm::AsyncCompileJob::CancelPendingForegroundTask
  v8::internal::wasm::AsyncCompileJob::~AsyncCompileJob
  
Sanitizer: undefined (UBSAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=583009:583010
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=589344:589345

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6243582865047552

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/40df6ed8d086e9c7946583857b57098972999633

commit 40df6ed8d086e9c7946583857b57098972999633
Author: Clemens Hammacher <clemensh@chromium.org>
Date: Fri Sep 07 08:09:47 2018

[wasm] Test worker termination while compiling

If a worker terminates while a wasm finisher task is scheduled, we try
to cancel that task even though the platform already deleted it. This
results in UBSan failures, ASan failures or crashes.
The bug itself is fixed on the v8 side in https://crrev.com/c/1209344,
but the test needs to be a layout test, thus on the chromium side.

R=ahaas@chromium.org

Bug:  chromium:875579 
Change-Id: I98f19869044299801eb521d97f417b403ca356c0
Reviewed-on: https://chromium-review.googlesource.com/1209602
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#589459}
[add] https://crrev.com/40df6ed8d086e9c7946583857b57098972999633/third_party/WebKit/LayoutTests/http/tests/wasm/wasm_worker_termination_while_compiling.html

ClusterFuzz testcase 6243582865047552 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Let's merge #9 to M-70 after some canary coverage.

Your change meets the bar and is auto-approved for M70. Please go ahead and merge the CL to branch 3538 manually. Please contact milestone owner if you have questions.
Owners: benmason@(Android), kariahda@(iOS), geohsu@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/a8c173e1e083bc25941614085804ef4e522c5d8e

commit a8c173e1e083bc25941614085804ef4e522c5d8e
Author: Clemens Hammacher <clemensh@chromium.org>
Date: Mon Sep 10 08:24:57 2018

Merged: [wasm] Fix worker termination while compiling

If a web worker terminates while a wasm finisher task is scheduled, we
try to cancel that task even though the platform already deleted it.
This results in UBSan failures, ASan failures or crashes.

This CL fixes this by deregistering the foreground task when it is
deleted before being executed.
A layout test for this will be added to chromium in
https://crrev.com/c/1209602.

R=​ahaas@chromium.org

Bug:  chromium:875579 
Change-Id: Idb2488dde9160e467a4d927d1743a451235d26b3
Originally-reviewed-on: https://chromium-review.googlesource.com/1209344
No-Try: true
No-Presubmit: true
No-Treechecks: true
Reviewed-on: https://chromium-review.googlesource.com/1215622
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.0@{#13}
Cr-Branched-From: 6e2adae6f7f8e891cfd01f3280482b20590427a6-refs/heads/7.0.276@{#1}
Cr-Branched-From: bc08a8624cbbea7a2d30071472bc73ad9544eadf-refs/heads/master@{#55424}
[modify] https://crrev.com/a8c173e1e083bc25941614085804ef4e522c5d8e/src/wasm/module-compiler.cc

The NextAction date has arrived: 2018-09-10

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot