v8_wasm_compile_wasmgc_fuzzer: Abrt in v8::base::BoundedPageAllocator::FreePages [400327467]

Assigned

Bug

ClusterFuzz

Stability-Memory-AddressSanitizer

Stability-AFL

Stability-Crash

Test-Predator-Auto-Components

Test-Predator-Auto-Owner

Unreproducible

Status Update

No update yet.

Description

24...@project.gserviceaccount.com

created issue #1

Mar 3, 2025 06:59AM

Detailed Report:

https://clusterfuzz.com/testcase?key=6429072770924544

Fuzzing Engine: centipede
Fuzz Target: v8_wasm_compile_wasmgc_fuzzer
Job Type: centipede_chrome_asan_highend
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x05390000df03
Crash State:
v8::base::BoundedPageAllocator::FreePages
v8::internal::VirtualMemory::~VirtualMemory
v8::internal::DeleteMemoryChunk

Sanitizer: address (ASAN)

Regressed:

https://clusterfuzz.com/revisions?job=centipede_chrome_asan_highend&range=1426862:1426863

Reproducer Testcase:

https://clusterfuzz.com/download?testcase_id=6429072770924544

Issue filed automatically.

See

https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for instructions on reproducing this bug locally.

Comments

24...@project.gserviceaccount.com <24...@project.gserviceaccount.com> #2Mar 3, 2025 07:10AM

Tram, can you confirm that the behavior is correct if the modifier is moved to the composable inside the AnimatedPane?

24...@project.gserviceaccount.com <24...@project.gserviceaccount.com> #3Mar 3, 2025 07:10AM

Assigned to ch...@skia-public.iam.gserviceaccount.com.

Hi Max, yes when the modifiers are moved to the composable inside the AnimatedPane, the PB animations are better than when the modifiers are in the AnimatedPane itself

24...@project.gserviceaccount.com <24...@project.gserviceaccount.com> #4Mar 5, 2025 09:08AM

Given the straightforward workaround in comment#3, I'm going to downgrade the priority of this bug for now

IssueTracker

This issue is a part of the Chromium tracker.