New issue
Advanced search Search tips

Issue 894053 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Oct 11
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Ill in v8::internal::V8::InitializePlatform

Project Member Reported by ClusterFuzz, Oct 10

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6329223902658560

Fuzzer: libFuzzer_pdfium_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Ill
Crash Address: 0x0000036385f1
Crash State:
  v8::internal::V8::InitializePlatform
  InitializeV8Common
  InitializeV8ForPDFiumWithStartupData
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=598252:598253

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6329223902658560

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Oct 10

Components: Internals>Plugins>PDF
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Oct 10

Cc: dsinclair@chromium.org jam@chromium.org brucedaw...@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 3 by ClusterFuzz, Oct 10

Labels: Test-Predator-Auto-Owner
Owner: thestig@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/197722e10300d319c93bd04be3d3cfdfe4128f40 (Use pdfium{_xfa}_fuzzer source from PDFium.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Cc: -jam@chromium.org -brucedaw...@chromium.org -dsinclair@chromium.org mmoroz@chromium.org
And I probably broke the fuzzer. Looking...
Status: Started (was: Assigned)
https://pdfium-review.googlesource.com/c/pdfium/+/43832
Project Member

Comment 6 by bugdroid1@chromium.org, Oct 11

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/8dc38b40c10321a6858b000c3d0b7d90e4540dca

commit 8dc38b40c10321a6858b000c3d0b7d90e4540dca
Author: Lei Zhang <thestig@chromium.org>
Date: Thu Oct 11 05:20:54 2018

Fix double V8 initialization with fuzzers.

Commit 95860d7 added some new fuzzers, but they try to use both the
generic fuzzer's initialization code, as well as their own custom
initialization code.

Add a new "pdfium_public_fuzzer" GN template for these new fuzzers, so
they use their own initialization code rather than the generic one.

BUG= chromium:894053 
TBR=tsepez@chromium.org

Change-Id: I6110a199e1c64d7c0632f9966e146fd316b757ae
Reviewed-on: https://pdfium-review.googlesource.com/c/43832
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

[modify] https://crrev.com/8dc38b40c10321a6858b000c3d0b7d90e4540dca/testing/fuzzers/BUILD.gn

Status: Fixed (was: Started)
Project Member

Comment 8 by bugdroid1@chromium.org, Oct 11

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1d047e4e1932501aded6a891ca82c18e324df6e4

commit 1d047e4e1932501aded6a891ca82c18e324df6e4
Author: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Date: Thu Oct 11 06:34:44 2018

Roll src/third_party/pdfium 40be505a7023..265886b2befa (2 commits)

https://pdfium.googlesource.com/pdfium.git/+log/40be505a7023..265886b2befa


git log 40be505a7023..265886b2befa --date=short --no-merges --format='%ad %ae %s'
2018-10-11 thestig@chromium.org Update build rules for CFX_CodecMemory.
2018-10-11 thestig@chromium.org Fix double V8 initialization with fuzzers.


Created with:
  gclient setdep -r src/third_party/pdfium@265886b2befa

The AutoRoll server is located here: https://autoroll.skia.org/r/pdfium-autoroll

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.



BUG=chromium:894325, chromium:894053 
TBR=dsinclair@chromium.org

Change-Id: I6f07a4f8cd803a88ab825f30d07e8659e7fd8d4c
Reviewed-on: https://chromium-review.googlesource.com/c/1275450
Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#598690}
[modify] https://crrev.com/1d047e4e1932501aded6a891ca82c18e324df6e4/DEPS

Project Member

Comment 9 by ClusterFuzz, Oct 12

ClusterFuzz has detected this issue as fixed in range 598689:598690.

Detailed report: https://clusterfuzz.com/testcase?key=6329223902658560

Fuzzer: libFuzzer_pdfium_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Ill
Crash Address: 0x0000036385f1
Crash State:
  v8::internal::V8::InitializePlatform
  InitializeV8Common
  InitializeV8ForPDFiumWithStartupData
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=598252:598253
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=598689:598690

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6329223902658560

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 10 by ClusterFuzz, Oct 12

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 6329223902658560 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment