Skip to content

dartfuzz crash #61442

@rmacnak-google

Description

@rmacnak-google
import 'dart:typed_data';

Int64List var19 = Int64List(0);
int var61 = -9223372034707292161;
int? var62 = -34;
Map<int, String> var113 = <int, String>{39: 'kR\u{1f600}gSx', 5: ''};

foo0_2() {
  for (int loc1 in var19) {}
}

foo0_Extension0() {
  for (int loc0 = 0; loc0 < 35; loc0++) {
    int loc1 = 0;
    do {
      print(Int32x4List(42));
    } while (++loc1 < 15);
  }
}

foo1_Extension0() {
  for (int loc0 in Int16List(42)) {
    int loc1 = 0;
    do {
      var113.addAll(<int, String>{
        loc1: 'N3+&'.replaceRange(var61, var62, "X"),
      });
    } while (++loc1 < 4);
  }
}

main() {
  foo0_2();
  foo0_Extension0();
  foo1_Extension0();
}
$ out/ReleaseX64/dart --no_polymorphic_with_deopt fuzz.dart
===== CRASH =====
si_signo=Segmentation fault(11), si_code=SEGV_MAPERR(1), si_addr=0xffffffffffffffff
version=3.10.0-edge (main) (Unknown timestamp) on "linux_x64"
pid=1570415, thread=1570422, isolate_group=main(0x557235b4d950), isolate=main(0x557235b417a0)
os=linux, arch=x64, comp=no, sim=no
isolate_instructions=5571f5d2fca0, vm_instructions=5571f5d2fca0
fp=7fc67e07e3f0, sp=7fc67e07e3c8, pc=7fc696b26800
  pc 0x00007fc696b26800 fp 0x00007fc67e07e3f0 [Optimized] _TypedListIterator@8027147.moveNext+0xd0
  pc 0x00007fc696b26aba fp 0x00007fc67e07e438 [Unoptimized] foo1_Extension0+0xea
  pc 0x00007fc696b2262b fp 0x00007fc67e07e460 [Unoptimized] main+0x9b
  pc 0x00007fc696b22553 fp 0x00007fc67e07e488 [Unoptimized] main+0x73
  pc 0x00007fc696b22481 fp 0x00007fc67e07e4e8 [Unoptimized] _Closure@0150898.dyn:call+0x6d1
  pc 0x00007fc696b2106b fp 0x00007fc67e07e528 [Unoptimized] _delayEntrypointInvocation@1026248.<anonymous closure>+0x2bb
  pc 0x00007fc696b20d44 fp 0x00007fc67e07e590 [Unoptimized] _Closure@0150898.dyn:call+0x704
  pc 0x00007fc696b1fbdd fp 0x00007fc67e07e5e8 [Unoptimized] _RawReceivePort@1026248._handleMessage@1026248+0x18d
  pc 0x00007fc697803386 fp 0x00007fc67e07e660 [Stub] InvokeDartCode+0x96
  pc 0x00005571f5ee8003 fp 0x00007fc67e07e6d0 dart::DartEntry::InvokeFunction+0x193
  pc 0x00005571f5ee99cd fp 0x00007fc67e07e710 dart::DartLibraryCalls::HandleMessage+0x11d
  pc 0x00005571f5f0870c fp 0x00007fc67e07eca0 dart::IsolateMessageHandler::HandleMessage+0x33c
  pc 0x00005571f5f2b910 fp 0x00007fc67e07ed10 dart::MessageHandler::HandleMessages+0x130
  pc 0x00005571f5f2bd00 fp 0x00007fc67e07ed60 dart::MessageHandler::TaskCallback+0x1e0
  pc 0x00005571f6006eb7 fp 0x00007fc67e07ede0 dart::ThreadPool::WorkerLoop+0x127
  pc 0x00005571f6007112 fp 0x00007fc67e07ee10 dart::ThreadPool::Worker::Main+0x72
  pc 0x00005571f5fb6579 fp 0x00007fc67e07eed0 dart::ThreadStart+0xd9

c440213. log

Metadata

Metadata

Assignees

No one assigned

    Labels

    area-vmUse area-vm for VM related issues, including code coverage, and the AOT and JIT backends.crashProcess exits with SIGSEGV, SIGABRT, etc. An unhandled exception is not a crash.dartfuzzFound with Dart fuzzing (DartFuzz, libFuzzer, etc.)

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions