Skip to content

Commit 677920b

Browse files
backesbackes
authored
Fix classification of CSA_DCHECKs in V8 (#4257)
Use the CSA_DCHECK message instead of just classifying them as "Abrt" (see https://crbug.com/367623928). Reuse the logic for CSA_ASSERT.
1 parent ad6131e commit 677920b

File tree

3 files changed

+144
-2
lines changed

3 files changed

+144
-2
lines changed

‎src/clusterfuzz/_internal/tests/core/crash_analysis/stack_parsing/stack_analyzer_data/v8_csa_dcheck.txt‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
[Environment] ASAN_OPTIONS=alloc_dealloc_mismatch=0:allocator_may_return_null=1:allow_user_segv_handler=1:check_malloc_usable_size=0:detect_leaks=1:detect_odr_violation=0:detect_stack_use_after_return=1:external_symbolizer_path=/mnt/scratch0/clusterfuzz/resources/platform/linux/llvm-symbolizer:fast_unwind_on_fatal=1:handle_abort=1:handle_segv=1:handle_sigbus=1:handle_sigfpe=1:handle_sigill=1:handle_sigtrap=1:print_scariness=1:print_summary=1:print_suppressions=0:redzone=32:strict_memcmp=0:symbolize=1:symbolize_inline_frames=false:use_sigaltstack=1
2+
[Command line] /mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_1f17dda3b0e56007440db98eafbaad9618b3d0fa/revisions/d8 --random-seed=1710077318 --fuzzing --fuzzing --disable-abortjs --disable-in-process-stack-traces --no-stress-lazy-source-positions --turbo-instruction-scheduling --jit-fuzzing --no-wasm-generic-wrapper --no-enable-sse4_1 --fuzzing /mnt/scratch0/clusterfuzz/bot/inputs/disk/fuzz-28.js
3+
4+
+----------------------------------------Debug Build Stacktrace----------------------------------------+
5+
abort: CSA_DCHECK failed: Torque assert 'data.wrapper_budget > 0' failed [src/builtins/wasm-to-js.tq:66] [src/builtins/builtins-wasm-gen.cc:164]
6+
7+
==== JS stack trace =========================================
8+
9+
0: ExitFrame [pc: 0x76efbf82c13d]
10+
1: StubFrame [pc: 0x76efbf7fcc11]
11+
2: TurbofanStubWithContextFrame [pc: 0x76efa0000f7f]
12+
3: /* anonymous */ [0x7ecc00099b89] [/mnt/scratch0/clusterfuzz/bot/inputs/disk/fuzz-28.js:136] [bytecode=0x7e90000400c5 offset=347](this=0x7ecc0008177d <JSGlobalProxy>#0#)
13+
4: InternalFrame [pc: 0x76efbf43ea9c]
14+
5: EntryFrame [pc: 0x76efbf43e7df]
15+
16+
==== Details ================================================
17+
18+
[0]: ExitFrame [pc: 0x76efbf82c13d]
19+
[1]: StubFrame [pc: 0x76efbf7fcc11]
20+
[2]: TurbofanStubWithContextFrame [pc: 0x76efa0000f7f]
21+
[3]: /* anonymous */ [0x7ecc00099b89] [/mnt/scratch0/clusterfuzz/bot/inputs/disk/fuzz-28.js:136] [bytecode=0x7e90000400c5 offset=347](this=0x7ecc0008177d <JSGlobalProxy>#0#) {
22+
// heap-allocated locals
23+
var kTypeSectionCode = 0x7ecc00289415 <FixedArray[11]>#1#
24+
var kImportSectionCode = 1
25+
var kExportSectionCode = 2
26+
var kWasmFunctionTypeForm = 7
27+
var kNoSuperType = 96
28+
var kSig_v_v = 0x7ecc000000c9 <true>
29+
var Binary = 0x7ecc00289865 <Object map = 0x7ecc00082511>#2#
30+
var WasmModuleBuilder = 0x7ecc00289895 <JSFunction Binary (sfi = 0x7ecc00099245)>#3#
31+
var __v_5 = 0x7ecc00289aa5 <JSFunction WasmModuleBuilder (sfi = 0x7ecc000993f5)>#4#
32+
var __v_6 = 0x7ecc00000069 <undefined>
33+
var __v_7 = 0x7ecc00000069 <undefined>
34+
// expression stack (top to bottom)
35+
[14] : 0x7ecc0028a6a1 <Object map = 0x7ecc0009b0ad>#5#
36+
[13] : 0x7ecc00289979 <JSFunction emit_section (sfi = 0x7ecc000993c5)>#6#
37+
[12] : 0x7ecc0028995d <JSFunction emit_header (sfi = 0x7ecc00099395)>#7#
38+
[11] : 0x7ecc00289b65 <JSFunction toModule (sfi = 0x7ecc00099515)>#8#
39+
[10] : 0x7ecc00289b49 <JSFunction instantiate (sfi = 0x7ecc000994e5)>#9#
40+
[09] : 0x7ecc00289b19 <JSFunction toBuffer (sfi = 0x7ecc000994b5)>#10#
41+
[08] : 0x7ecc00289afd <JSFunction addExport (sfi = 0x7ecc00099485)>#11#
42+
[07] : 0x7ecc00289ae1 <JSFunction addImport (sfi = 0x7ecc00099455)>#12#
43+
[06] : 0x7ecc00289ac5 <JSFunction addType (sfi = 0x7ecc00099425)>#13#
44+
[05] : 0x7ecc00000791 <the_hole_value>#14#
45+
[04] : 0x7ecc00289f35 <Object map = 0x7ecc0009a8a9>#15#
46+
[03] : 0x7ecc00289f09 <Object map = 0x7ecc0009a84d>#16#
47+
[02] : 0x7ecc0028a6a1 <Object map = 0x7ecc0009b0ad>#5#
48+
[01] : 0x7ecc0009b069 <JSFunction js-to-wasm:: (sfi = 0x7ecc0009b039)>#17#
49+
[00] : 0x7ecc00000069 <undefined>
50+
--------- s o u r c e c o d e ---------
51+
var kWasmH0 = 0;\x0avar kWasmH1 = 0x61;\x0avar kWasmH2 = 0x73;\x0avar kWasmH3 = 0x6d;\x0avar kWasmV0 = 0x1;\x0avar kWasmV1 = 0;\x0avar kWasmV2 = 0;\x0avar kWasmV3 = 0;\x0alet kTypeSectionCode = 1;\x0alet kImportSectionCode = 2;\x0alet kExportSectionCode = 7;\x0alet kWasmFunctionTypeForm = 0x60;\x0alet kNoSuperType = 0xFFFFFFFF;\x0alet kS...
52+
53+
-----------------------------------------
54+
}
55+
56+
[4]: InternalFrame [pc: 0x76efbf43ea9c]
57+
[5]: EntryFrame [pc: 0x76efbf43e7df]
58+
-- ObjectCacheKey --
59+
60+
#0# 0x7ecc0008177d: 0x7ecc0008177d <JSGlobalProxy>
61+
#1# 0x7ecc00289415: 0x7ecc00289415 <FixedArray[11]>
62+
0: 1
63+
1: 1
64+
2: 1
65+
3: 1
66+
4: 0
67+
5: 1
68+
6: 1
69+
7: 1
70+
8: 1
71+
9: 1
72+
...
73+
#2# 0x7ecc00289865: 0x7ecc00289865 <Object map = 0x7ecc00082511>
74+
#3# 0x7ecc00289895: 0x7ecc00289895 <JSFunction Binary (sfi = 0x7ecc00099245)>
75+
#4# 0x7ecc00289aa5: 0x7ecc00289aa5 <JSFunction WasmModuleBuilder (sfi = 0x7ecc000993f5)>
76+
#5# 0x7ecc0028a6a1: 0x7ecc0028a6a1 <Object map = 0x7ecc0009b0ad>
77+
f: 0x7ecc0009b069 <JSFunction js-to-wasm:: (sfi = 0x7ecc0009b039)>#17#
78+
#6# 0x7ecc00289979: 0x7ecc00289979 <JSFunction emit_section (sfi = 0x7ecc000993c5)>
79+
#7# 0x7ecc0028995d: 0x7ecc0028995d <JSFunction emit_header (sfi = 0x7ecc00099395)>
80+
#8# 0x7ecc00289b65: 0x7ecc00289b65 <JSFunction toModule (sfi = 0x7ecc00099515)>
81+
#9# 0x7ecc00289b49: 0x7ecc00289b49 <JSFunction instantiate (sfi = 0x7ecc000994e5)>
82+
#10# 0x7ecc00289b19: 0x7ecc00289b19 <JSFunction toBuffer (sfi = 0x7ecc000994b5)>
83+
#11# 0x7ecc00289afd: 0x7ecc00289afd <JSFunction addExport (sfi = 0x7ecc00099485)>
84+
#12# 0x7ecc00289ae1: 0x7ecc00289ae1 <JSFunction addImport (sfi = 0x7ecc00099455)>
85+
#13# 0x7ecc00289ac5: 0x7ecc00289ac5 <JSFunction addType (sfi = 0x7ecc00099425)>
86+
#14# 0x7ecc00000791: 0x7ecc00000791 <the_hole_value>
87+
#15# 0x7ecc00289f35: 0x7ecc00289f35 <Object map = 0x7ecc0009a8a9>
88+
f: 0x7ecc00289f61 <JSFunction f (sfi = 0x7ecc00099545)>#18#
89+
#16# 0x7ecc00289f09: 0x7ecc00289f09 <Object map = 0x7ecc0009a84d>
90+
m: 0x7ecc00289f35 <Object map = 0x7ecc0009a8a9>#15#
91+
#17# 0x7ecc0009b069: 0x7ecc0009b069 <JSFunction js-to-wasm:: (sfi = 0x7ecc0009b039)>
92+
#18# 0x7ecc00289f61: 0x7ecc00289f61 <JSFunction f (sfi = 0x7ecc00099545)>
93+
=====================
94+
95+
AddressSanitizer:DEADLYSIGNAL
96+
=================================================================
97+
==480==ERROR: AddressSanitizer: ABRT on unknown address 0x0539000001e0 (pc 0x7aeff105100b bp 0x7ffe9f2d2530 sp 0x7ffe9f2d22e0 T0)
98+
SCARINESS: 10 (signal)
99+
#0 0x7aeff105100b in raise /build/glibc-LcI20x/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1
100+
#1 0x7aeff9810bc0 in v8::internal::__RT_impl_Runtime_AbortCSADcheck(v8::internal::Arguments<(v8::internal::ArgumentsType)0>, v8::internal::Isolate*) src/runtime/runtime-test.cc:1515:3
101+
#2 0x7aeff9810109 in v8::internal::Runtime_AbortCSADcheck(int, unsigned long*, v8::internal::Isolate*) src/runtime/runtime-test.cc:1496:1
102+
#3 0x76efbf82c13c in Builtins_AsyncFromSyncIteratorPrototypeReturn setup-isolate-deserialize.cc
103+
#4 0x76efbf7fcc10 in Builtins_WasmToJsWrapperCSA setup-isolate-deserialize.cc
104+
#5 0x76efa0000f7e (<unknown module>)
105+
#6 0x76efbf447a0e in Builtins_StringSubstring setup-isolate-deserialize.cc
106+
#7 0x76efbf43ea9b in Builtins_ConstructProxy setup-isolate-deserialize.cc
107+
#8 0x76efbf43e7de in Builtins_ConstructProxy setup-isolate-deserialize.cc
108+
#9 0x7aeff7a2dabc in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) src/execution/simulator.h:187:12
109+
#10 0x7aeff7a3177c in v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::Handle<v8::internal::JSFunction>, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>) src/execution/execution.cc:517:10
110+
#11 0x7aeff6f07ed3 in v8::Script::Run(v8::Local<v8::Context>, v8::Local<v8::Data>) src/api/api.cc:2138:7
111+
#12 0x571c4a7e1075 in v8::Shell::ExecuteString(v8::Isolate*, v8::Local<v8::String>, v8::Local<v8::String>, v8::Shell::ReportExceptions, v8::Global<v8::Value>*) src/d8/d8.cc:1007:44
112+
#13 0x571c4a813a13 in v8::SourceGroup::Execute(v8::Isolate*) src/d8/d8.cc:4850:10
113+
#14 0x571c4a81f23b in v8::Shell::RunMainIsolate(v8::Isolate*, bool) src/d8/d8.cc:5784:37
114+
#15 0x571c4a81e694 in v8::Shell::RunMain(v8::Isolate*, bool) src/d8/d8.cc:5693:18
115+
#16 0x571c4a821975 in v8::Shell::Main(int, char**) src/d8/d8.cc:6546:18
116+
#17 0x7aeff1032082 in __libc_start_main /build/glibc-LcI20x/glibc-2.31/csu/../csu/libc-start.c:308:16
117+
118+
==480==Register values:
119+
rax = 0x0000000000000000 rbx = 0x00007aeffe5ea8c0 rcx = 0x00007aeff105100b rdx = 0x0000000000000000
120+
rdi = 0x0000000000000002 rsi = 0x00007ffe9f2d22e0 rbp = 0x00007ffe9f2d2530 rsp = 0x00007ffe9f2d22e0
121+
r8 = 0x0000000000000000 r9 = 0x00007ffe9f2d22e0 r10 = 0x0000000000000008 r11 = 0x0000000000000246
122+
r12 = 0x0000000000000005 r13 = 0x00000f3ffe09c242 r14 = 0x000079fff04e1000 r15 = 0x000077aff04e2b00
123+
AddressSanitizer can not provide additional info.
124+
SUMMARY: AddressSanitizer: ABRT /build/glibc-LcI20x/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1 in raise
125+
==480==ABORTING

‎src/clusterfuzz/_internal/tests/core/crash_analysis/stack_parsing/stack_analyzer_test.py‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1250,6 +1250,22 @@ def test_v8_sandbox_violation_asan(self):
12501250
expected_state, expected_stacktrace,
12511251
expected_security_flag)
12521252

1253+
def test_v8_csa_dcheck(self):
1254+
"""Test a v8 CSA_DCHECK failure."""
1255+
data = self._read_test_data('v8_csa_dcheck.txt')
1256+
expected_type = 'ASSERT'
1257+
expected_address = ''
1258+
expected_state = (
1259+
'CSA_DCHECK failed: Torque assert \'data.wrapper_budget > 0\' failed\n'
1260+
'wasm-to-js.tq\n')
1261+
1262+
expected_stacktrace = data
1263+
expected_security_flag = True
1264+
1265+
self._validate_get_crash_data(data, expected_type, expected_address,
1266+
expected_state, expected_stacktrace,
1267+
expected_security_flag)
1268+
12531269
def test_generic_segv(self):
12541270
"""Test a SEGV caught by a generic signal handler."""
12551271
data = self._read_test_data('generic_segv.txt')

‎src/clusterfuzz/stacktraces/constants.py‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -302,8 +302,9 @@
302302
UBSAN_VPTR_INVALID_OFFSET_REGEX = re.compile(
303303
r'.*at offset (\d+) within object of type (.*)')
304304
UBSAN_VPTR_INVALID_VPTR_REGEX = re.compile(r'.*note: object has invalid vptr')
305-
V8_ABORT_FAILURE_REGEX = re.compile(r'^abort: (CSA_ASSERT failed:.*)')
306-
V8_ABORT_METADATA_REGEX = re.compile(r'(.*) \[(.*):\d+\]$')
305+
V8_ABORT_FAILURE_REGEX = re.compile(
306+
r'^abort: (CSA_(?:ASSERT|DCHECK) failed: .*)')
307+
V8_ABORT_METADATA_REGEX = re.compile(r'(.*?) \[(.*):\d+\]$')
307308
V8_CORRECTNESS_FAILURE_REGEX = re.compile(r'#\s*V8 correctness failure')
308309
V8_CORRECTNESS_METADATA_REGEX = re.compile(
309310
r'#\s*V8 correctness ((configs|sources|suppression): .*)')

0 commit comments

Comments
 (0)