Stream: git-wasmtime

Topic: wasmtime / issue #4641 cranelift-fuzzgen: Differing value...

view this post on Zulip Wasmtime GitHub notifications bot (Aug 08 2022 at 17:19):

alexcrichton labeled issue #4641:

Given this input: input.gz on the current main branch (650979ae405afc8b87935172189774cb1f24a8a3) this yields:

$ cargo +nightly fuzz run --strip-dead-code --no-default-features -s none cranelift-fuzzgen ./input
    Finished release [optimized] target(s) in 0.13s
    Finished release [optimized] target(s) in 0.12s
     Running `target/aarch64-unknown-linux-gnu/release/cranelift-fuzzgen -artifact_prefix=/home/acrichto/code/wasmtime/fuzz/artifacts/cranelift-fuzzgen/ ./clusterfuzz-testcase-minimized-cranelift-fuzzgen-5103368686665728`
WARNING: Failed to find function "__sanitizer_acquire_crash_state".
WARNING: Failed to find function "__sanitizer_print_stack_trace".
WARNING: Failed to find function "__sanitizer_set_death_callback".
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 2178409417
INFO: Loaded 1 modules   (57039 inline 8-bit counters): 57039 [0xaaaadf42dbd8, 0xaaaadf43baa7),
INFO: Loaded 1 PC tables (57039 PCs): 57039 [0xaaaadf43baa8,0xaaaadf51a798),
target/aarch64-unknown-linux-gnu/release/cranelift-fuzzgen: Running 1 inputs 1 time(s) each.
Running: ./clusterfuzz-testcase-minimized-cranelift-fuzzgen-5103368686665728
thread '<unnamed>' panicked at 'assertion failed: `(left == right)`
  left: `[I32(-1019936512), B(false), B(false), I8(-126), F32(Ieee32(9013641)), I128(7036874417766400), I16(0), I128(7036874417766400), I8(-126), I32(-1019936512), B(false), I8(-126), F32(Ieee32(9013641)), I128(7036874417766400), I8(-126), I64(-9079256848775774208)]`,
 right: `[I32(-1019936512), B(false), B(false), I8(-126), F32(Ieee32(9013641)), I128(7036874417766400), I16(0), I128(7036874417766400), I8(0), I32(-1983678781), B(false), I8(0), F32(Ieee32(3279340483)), I128(7036874417766400), I8(0), I64(-9079256848775774208)]`', fuzz/fuzz_targets/cranelift-fuzzgen.rs:102:9
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
==34721== ERROR: libFuzzer: deadly signal
NOTE: libFuzzer has rudimentary signal handlers.
      Combine libFuzzer with AddressSanitizer or similar for better crash reports.
SUMMARY: libFuzzer: deadly signal
────────────────────────────────────────────────────────────────────────────────

cc @afonso360

view this post on Zulip Wasmtime GitHub notifications bot (Aug 08 2022 at 17:19):

alexcrichton opened issue #4641:

Given this input: input.gz on the current main branch (650979ae405afc8b87935172189774cb1f24a8a3) this yields:

$ cargo +nightly fuzz run --strip-dead-code --no-default-features -s none cranelift-fuzzgen ./input
    Finished release [optimized] target(s) in 0.13s
    Finished release [optimized] target(s) in 0.12s
     Running `target/aarch64-unknown-linux-gnu/release/cranelift-fuzzgen -artifact_prefix=/home/acrichto/code/wasmtime/fuzz/artifacts/cranelift-fuzzgen/ ./clusterfuzz-testcase-minimized-cranelift-fuzzgen-5103368686665728`
WARNING: Failed to find function "__sanitizer_acquire_crash_state".
WARNING: Failed to find function "__sanitizer_print_stack_trace".
WARNING: Failed to find function "__sanitizer_set_death_callback".
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 2178409417
INFO: Loaded 1 modules   (57039 inline 8-bit counters): 57039 [0xaaaadf42dbd8, 0xaaaadf43baa7),
INFO: Loaded 1 PC tables (57039 PCs): 57039 [0xaaaadf43baa8,0xaaaadf51a798),
target/aarch64-unknown-linux-gnu/release/cranelift-fuzzgen: Running 1 inputs 1 time(s) each.
Running: ./clusterfuzz-testcase-minimized-cranelift-fuzzgen-5103368686665728
thread '<unnamed>' panicked at 'assertion failed: `(left == right)`
  left: `[I32(-1019936512), B(false), B(false), I8(-126), F32(Ieee32(9013641)), I128(7036874417766400), I16(0), I128(7036874417766400), I8(-126), I32(-1019936512), B(false), I8(-126), F32(Ieee32(9013641)), I128(7036874417766400), I8(-126), I64(-9079256848775774208)]`,
 right: `[I32(-1019936512), B(false), B(false), I8(-126), F32(Ieee32(9013641)), I128(7036874417766400), I16(0), I128(7036874417766400), I8(0), I32(-1983678781), B(false), I8(0), F32(Ieee32(3279340483)), I128(7036874417766400), I8(0), I64(-9079256848775774208)]`', fuzz/fuzz_targets/cranelift-fuzzgen.rs:102:9
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
==34721== ERROR: libFuzzer: deadly signal
NOTE: libFuzzer has rudimentary signal handlers.
      Combine libFuzzer with AddressSanitizer or similar for better crash reports.
SUMMARY: libFuzzer: deadly signal
────────────────────────────────────────────────────────────────────────────────

cc @afonso360

view this post on Zulip Wasmtime GitHub notifications bot (Aug 09 2022 at 10:47):

afonso360 commented on issue #4641:

This is related to / a dup of #4568 .

@cfallin would you be able to take a look at that issue and provide some input as to how we should proceed?

view this post on Zulip Wasmtime GitHub notifications bot (Aug 09 2022 at 18:00):

cfallin commented on issue #4641:

@afonso360 just noted on that issue -- I agree with the proposed fix to i128-constant semantics.

view this post on Zulip Wasmtime GitHub notifications bot (Aug 15 2022 at 18:08):

cfallin closed issue #4641:

Given this input: input.gz on the current main branch (650979ae405afc8b87935172189774cb1f24a8a3) this yields:

$ cargo +nightly fuzz run --strip-dead-code --no-default-features -s none cranelift-fuzzgen ./input
    Finished release [optimized] target(s) in 0.13s
    Finished release [optimized] target(s) in 0.12s
     Running `target/aarch64-unknown-linux-gnu/release/cranelift-fuzzgen -artifact_prefix=/home/acrichto/code/wasmtime/fuzz/artifacts/cranelift-fuzzgen/ ./clusterfuzz-testcase-minimized-cranelift-fuzzgen-5103368686665728`
WARNING: Failed to find function "__sanitizer_acquire_crash_state".
WARNING: Failed to find function "__sanitizer_print_stack_trace".
WARNING: Failed to find function "__sanitizer_set_death_callback".
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 2178409417
INFO: Loaded 1 modules   (57039 inline 8-bit counters): 57039 [0xaaaadf42dbd8, 0xaaaadf43baa7),
INFO: Loaded 1 PC tables (57039 PCs): 57039 [0xaaaadf43baa8,0xaaaadf51a798),
target/aarch64-unknown-linux-gnu/release/cranelift-fuzzgen: Running 1 inputs 1 time(s) each.
Running: ./clusterfuzz-testcase-minimized-cranelift-fuzzgen-5103368686665728
thread '<unnamed>' panicked at 'assertion failed: `(left == right)`
  left: `[I32(-1019936512), B(false), B(false), I8(-126), F32(Ieee32(9013641)), I128(7036874417766400), I16(0), I128(7036874417766400), I8(-126), I32(-1019936512), B(false), I8(-126), F32(Ieee32(9013641)), I128(7036874417766400), I8(-126), I64(-9079256848775774208)]`,
 right: `[I32(-1019936512), B(false), B(false), I8(-126), F32(Ieee32(9013641)), I128(7036874417766400), I16(0), I128(7036874417766400), I8(0), I32(-1983678781), B(false), I8(0), F32(Ieee32(3279340483)), I128(7036874417766400), I8(0), I64(-9079256848775774208)]`', fuzz/fuzz_targets/cranelift-fuzzgen.rs:102:9
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
==34721== ERROR: libFuzzer: deadly signal
NOTE: libFuzzer has rudimentary signal handlers.
      Combine libFuzzer with AddressSanitizer or similar for better crash reports.
SUMMARY: libFuzzer: deadly signal
────────────────────────────────────────────────────────────────────────────────

cc @afonso360

Last updated: Dec 23 2024 at 13:07 UTC