googleprojectzero / googleprojectzero/fuzzilli

Fatal error: Unknown frame type in `DiffOracle.parseFrameType` during differential execution (DumplingDiffOracle)

Open
#552 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Swift
Stars
2.3k
Forks
367
Avg merge
23h 53m
Merged PRs (30d)
1

Description

Summary

Fuzzilli crashes with a fatal error when the Dumpling differential oracle encounters an unknown frame type.

The crash happens in parseFrameType because a new/unknown frame prefix appeared in the dump that is not handled in the switch.

Crash Details
Fuzzilli/Oracle.swift:184: Fatal error: Unknown frame type
💣 Program crashed: Illegal instruction at 0x00007ad78b2e2af8

Platform: x86_64 Linux (Ubuntu 22.04.5 LTS)

Thread 5 crashed:
 0  _assertionFailure(_:_:file:line:flags:) + 264 in libswiftCore.so
 1  parseFrameType #1 (_:) in static DiffOracle.parseDiffFrame(_:_:_:_:) + 292
    at Sources/Fuzzilli/DumplingDiffOracle/Oracle.swift:184:17

   182│ case "---D": .deoptTurbofan
   183│ default:
   184│     fatalError("Unknown frame type")
      │     ▲
   185│ }

... (full backtrace continues through parseFullFrames → relate → DiffExecution.diff → executeDifferentialIfNeeded)

Backtrace key points:

  • DiffOracle.parseDiffFrame
  • DiffOracle.parseFullFrames
  • DiffOracle.relate(optIn:with:)
  • DiffExecution.diff(...)
  • Fuzzer.executeDifferentialIfNeededFuzzer.executeFuzzer.importProgram
Actual Behavior

Hard fatalError → immediate crash of the fuzzer process.

Commit ID
cbade79edaf1dae0c233890b7957f560008d2c63
Environment
  • Proxmox PVE Ubuntu 22.04 VM
  • 60 cores
  • 64 GB Ram
  • 150gb nvme
Command Used:
swift run -c release FuzzilliCli --profile=v8Dumpling --jobs=60 --storagePath=/home/saqib/Desktop/dump --swarmTesting --forDifferentialFuzzing /home/{$USER}/Desktop/v8/out/fuzzbuild/d8

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in Sources/Fuzzilli/DumplingDiffOracle/Oracle.swift at parseDiffFrame and parseFrameType, then trace parseFullFrames and relate. Reproduce with the v8Dumpling differential-fuzzing command and inspect the unknown dump prefix; done means the encountered frame no longer causes an immediate fuzzer crash and its handling is validated.

Written by the indexing model from the issue text.

Assessment

Tech stack
swift
Domain
testing-qa, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.