New issue
Advanced search Search tips

Issue 877791 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Oct 4
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security



Sign in to add a comment

CHECK failure: it->second == vreg in register-allocator-verifier.h

Project Member Reported by ClusterFuzz, Aug 25

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5408264288993280

Fuzzer: binaryen_wasm_fuzzer
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  it->second == vreg in register-allocator-verifier.h
  v8::internal::compiler::RegisterAllocatorVerifier::DelayedAssessments::AddDelaye
  v8::internal::compiler::RegisterAllocatorVerifier::ValidatePendingAssessment
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_v8_arm_dbg&range=55415:55416

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5408264288993280

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Aug 25

Components: Blink>JavaScript>Compiler
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Aug 25

Labels: Test-Predator-Auto-Owner
Owner: gdeepti@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/8fe01fea4e1d7591645f89fb155a6a6bd89ed3b4 ([arm] Implement I64Atomic operations on Arm).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Project Member

Comment 3 by sheriffbot@chromium.org, Aug 26

Labels: Pri-1
Labels: M-70 Security_Impact-None
Security_Impact-None because it doesn't seem to be a security issue, just a check for an unexpected condition.

gdeepti -- can you please comment on what happens in the absence of this CHECK? Thanks.
Components: -Blink>JavaScript -Blink>JavaScript>Compiler Blink>JavaScript>WebAssembly
Security_Impact-None is correct as this will only be executed behind a flag, and the case that this is hitting is when the output nodes are optimized, this is the first in the series of checks to make sure that nothing unexpected happens. 
Cc: clemensh@chromium.org ahaas@chromium.org gdeepti@chromium.org
 Issue 882084  has been merged into this issue.
Project Member

Comment 7 by ClusterFuzz, Oct 4

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5153121645625344 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 8 by ClusterFuzz, Oct 4

ClusterFuzz has detected this issue as fixed in range 56359:56360.

Detailed report: https://clusterfuzz.com/testcase?key=5408264288993280

Fuzzer: binaryen_wasm_fuzzer
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  it->second == vreg in register-allocator-verifier.h
  v8::internal::compiler::RegisterAllocatorVerifier::DelayedAssessments::AddDelaye
  v8::internal::compiler::RegisterAllocatorVerifier::ValidatePendingAssessment
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_v8_arm_dbg&range=55415:55416
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_v8_arm_dbg&range=56359:56360

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5408264288993280

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by sheriffbot@chromium.org, Oct 4

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Labels: -reward-topanel reward-0
I'm afraid the VRP panel declined to reward for this, as it's a CHECK in a work in progress feature.
Project Member

Comment 11 by sheriffbot@chromium.org, Jan 10

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment