New issue
Advanced search Search tips

Issue 898677 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Oct 31
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 1
Type: Bug



Sign in to add a comment

Ill in v8::internal::GrowMemoryBuffer

Project Member Reported by ClusterFuzz, Oct 24

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6501319408615424

Fuzzer: ochang_js_fuzzer
Job Type: linux_asan_d8
Platform Id: linux

Crash Type: Ill
Crash Address: 0x55c687584c88
Crash State:
  v8::internal::GrowMemoryBuffer
  v8::internal::WasmMemoryObject::Grow
  v8::WebAssemblyMemoryGrow
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8&range=54645:54646

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6501319408615424

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Cc: titzer@chromium.org
Components: -Blink>JavaScript Blink>JavaScript>WebAssembly
Labels: -OS-Linux
Owner: clemensh@chromium.org
Status: Started (was: Untriaged)
The test is passing an invalid value '--wasm-max-mem-pages=49152'. It took this from an existing test.
Will fix this by checking the flag value explicitly in wasm engine initialization, and fixing our tests to only pass valid values (<= kV8MaxWasmMemoryPages).
Hm, turns out the flag --wasm-max-mem-pages=49152 is there explicitly to test that memories >2GB work. So we should change the CHECK instead to use FLAG_wasm_max_mem_pages instead of V8MaxWasmMemoryPages.
Project Member

Comment 3 by bugdroid1@chromium.org, Oct 30

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/fac176d81359c08fb88348675375a6c0a3599838

commit fac176d81359c08fb88348675375a6c0a3599838
Author: Clemens Hammacher <clemensh@chromium.org>
Date: Tue Oct 30 13:44:48 2018

[wasm] Fix memory limit checks

For memory limit checks, we should use the minimum of the
--wasm-max-mem-pages flag and kV8MaxWasmMemoryPages. The former is a
limit set by the user, the latter is the maximum we can handle
internally.

R=titzer@chromium.org

Bug:  chromium:898677 
Change-Id: I3c549f4e90dd016b5d07475d9353f30134f76dcc
Reviewed-on: https://chromium-review.googlesource.com/c/1305274
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57127}
[modify] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/src/asmjs/asm-js.cc
[modify] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/src/wasm/compilation-environment.h
[modify] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/src/wasm/module-compiler.cc
[modify] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/src/wasm/module-decoder.cc
[modify] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/src/wasm/wasm-engine.cc
[modify] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/src/wasm/wasm-js.cc
[modify] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/src/wasm/wasm-limits.h
[modify] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/src/wasm/wasm-memory.cc
[modify] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/src/wasm/wasm-objects.cc
[add] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/test/mjsunit/regress/wasm/regress-898932.js
[modify] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/test/mjsunit/wasm/huge-memory.js

Project Member

Comment 4 by ClusterFuzz, Oct 31

ClusterFuzz has detected this issue as fixed in range 57126:57127.

Detailed report: https://clusterfuzz.com/testcase?key=6501319408615424

Fuzzer: ochang_js_fuzzer
Job Type: linux_asan_d8
Platform Id: linux

Crash Type: Ill
Crash Address: 0x55c687584c88
Crash State:
  v8::internal::GrowMemoryBuffer
  v8::internal::WasmMemoryObject::Grow
  v8::WebAssemblyMemoryGrow
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8&range=54645:54646
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8&range=57126:57127

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6501319408615424

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Oct 31

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 6501319408615424 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment