Ill in v8::internal::GrowMemoryBuffer |
||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6501319408615424 Fuzzer: ochang_js_fuzzer Job Type: linux_asan_d8 Platform Id: linux Crash Type: Ill Crash Address: 0x55c687584c88 Crash State: v8::internal::GrowMemoryBuffer v8::internal::WasmMemoryObject::Grow v8::WebAssemblyMemoryGrow Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8&range=54645:54646 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6501319408615424 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Oct 26
Hm, turns out the flag --wasm-max-mem-pages=49152 is there explicitly to test that memories >2GB work. So we should change the CHECK instead to use FLAG_wasm_max_mem_pages instead of V8MaxWasmMemoryPages.
,
Oct 30
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/fac176d81359c08fb88348675375a6c0a3599838 commit fac176d81359c08fb88348675375a6c0a3599838 Author: Clemens Hammacher <clemensh@chromium.org> Date: Tue Oct 30 13:44:48 2018 [wasm] Fix memory limit checks For memory limit checks, we should use the minimum of the --wasm-max-mem-pages flag and kV8MaxWasmMemoryPages. The former is a limit set by the user, the latter is the maximum we can handle internally. R=titzer@chromium.org Bug: chromium:898677 Change-Id: I3c549f4e90dd016b5d07475d9353f30134f76dcc Reviewed-on: https://chromium-review.googlesource.com/c/1305274 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by: Ben Titzer <titzer@chromium.org> Cr-Commit-Position: refs/heads/master@{#57127} [modify] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/src/asmjs/asm-js.cc [modify] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/src/wasm/compilation-environment.h [modify] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/src/wasm/module-compiler.cc [modify] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/src/wasm/module-decoder.cc [modify] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/src/wasm/wasm-engine.cc [modify] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/src/wasm/wasm-js.cc [modify] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/src/wasm/wasm-limits.h [modify] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/src/wasm/wasm-memory.cc [modify] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/src/wasm/wasm-objects.cc [add] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/test/mjsunit/regress/wasm/regress-898932.js [modify] https://crrev.com/fac176d81359c08fb88348675375a6c0a3599838/test/mjsunit/wasm/huge-memory.js
,
Oct 31
ClusterFuzz has detected this issue as fixed in range 57126:57127. Detailed report: https://clusterfuzz.com/testcase?key=6501319408615424 Fuzzer: ochang_js_fuzzer Job Type: linux_asan_d8 Platform Id: linux Crash Type: Ill Crash Address: 0x55c687584c88 Crash State: v8::internal::GrowMemoryBuffer v8::internal::WasmMemoryObject::Grow v8::WebAssemblyMemoryGrow Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8&range=54645:54646 Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8&range=57126:57127 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6501319408615424 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Oct 31
ClusterFuzz testcase 6501319408615424 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||
►
Sign in to add a comment |
||
Comment 1 by clemensh@chromium.org
, Oct 26Components: -Blink>JavaScript Blink>JavaScript>WebAssembly
Labels: -OS-Linux
Owner: clemensh@chromium.org
Status: Started (was: Untriaged)