T0b1/wasmtime
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Disable reference types in v8 fuzzing (#4387)

Browse Source 
OSS-fuzz long-ago discovered https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45662
which we currently believe to be a bug in v8. I originally thought it
was going to be fixed with https://bugs.chromium.org/p/v8/issues/detail?id=12722
but that no longer appears to be the case now that the `v8` crate has
caught up and it still isn't fixed. Personally I've sort of lost an
appetite for continuing to debug these issues so I figure it's best to
just disable reference types with v8 for now and exercise the rest of
the engine, e.g. simd.
This commit is contained in:
Alex Crichton
2022-07-05 15:43:37 -05:00
committed by GitHub
parent 925891245d
commit 308a0fcc06
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
fuzz/fuzz_targets/differential_v8.rs
View File

@@ -19,7 +19,16 @@ fn run(data: &[u8]) -> Result<()> {
// Enable features that v8 has implemented
config.module_config.config.simd_enabled = u.arbitrary()?;
config.module_config.config.bulk_memory_enabled = u.arbitrary()?;
config.module_config.config.reference_types_enabled = u.arbitrary()?;
// FIXME: reference types are disabled for now as we seemingly keep finding
// a segfault in v8. This is found relatively quickly locally and keeps
// getting found by oss-fuzz and currently we don't think that there's
// really much we can do about it. For the time being disable reference
// types entirely. An example bug is
// https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45662
//
// config.module_config.config.reference_types_enabled = u.arbitrary()?;
// FIXME: to enable fuzzing with the threads proposal, see
// https://github.com/bytecodealliance/wasmtime/issues/4268.
// config.module_config.config.threads_enabled = u.arbitrary()?;