• Andreas Haas's avatar
    [wasm][fuzzer] Do not execute code with potential non-determinism · 8f07a87d
    Andreas Haas authored
    The WebAssembly spec is not fully deterministic: the sign bit of NaN
    can be arbitrary. This sign bit can be observed by several WebAssembly
    opcodes. In the testcase the sign bit of NaN makes the difference
    between terminating code and an infinite loop.
    
    In the libfuzzer fuzzer we have to prevent infinite loops ourselves.
    At the moment we do this by only execute generated code of WebAssembly
    modules for which the interpretation of the code ends in a limited
    number of steps. With the non-determinism described above we cannot
    guarantee the absence of infinite loops with this method. Therefore
    we stop now to execute generated code of WebAssembly modules for which
    we observe possible non-determinism in the interpreter.
    
    R=clemensh@chromium.org
    
    Bug: chromium:863829
    Change-Id: I461d67df87d672bed25d6c915ba7ea5134cb5890
    Reviewed-on: https://chromium-review.googlesource.com/1141945Reviewed-by: 's avatarClemens Hammacher <clemensh@chromium.org>
    Commit-Queue: Andreas Haas <ahaas@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#54541}
    8f07a87d
Name
Last commit
Last update
..
json Loading commit data...
multi_return Loading commit data...
parser Loading commit data...
regexp Loading commit data...
regexp_builtins Loading commit data...
wasm Loading commit data...
wasm_async Loading commit data...
wasm_code Loading commit data...
wasm_compile Loading commit data...
wasm_data_section Loading commit data...
wasm_function_sigs_section Loading commit data...
wasm_globals_section Loading commit data...
wasm_imports_section Loading commit data...
wasm_memory_section Loading commit data...
wasm_names_section Loading commit data...
wasm_types_section Loading commit data...
BUILD.gn Loading commit data...
DEPS Loading commit data...
README.md Loading commit data...
fuzzer-support.cc Loading commit data...
fuzzer-support.h Loading commit data...
fuzzer.cc Loading commit data...
fuzzer.status Loading commit data...
json.cc Loading commit data...
multi-return.cc Loading commit data...
parser.cc Loading commit data...
regexp-builtins.cc Loading commit data...
regexp.cc Loading commit data...
testcfg.py Loading commit data...
wasm-async.cc Loading commit data...
wasm-code.cc Loading commit data...
wasm-compile.cc Loading commit data...
wasm-data-section.cc Loading commit data...
wasm-function-sigs-section.cc Loading commit data...
wasm-fuzzer-common.cc Loading commit data...
wasm-fuzzer-common.h Loading commit data...
wasm-globals-section.cc Loading commit data...
wasm-imports-section.cc Loading commit data...
wasm-memory-section.cc Loading commit data...
wasm-names-section.cc Loading commit data...
wasm-types-section.cc Loading commit data...
wasm.cc Loading commit data...
wasm_corpus.tar.gz.sha1 Loading commit data...