googleprojectzero / googleprojectzero/fuzzilli
Fatal error: Unknown frame type in `DiffOracle.parseFrameType` during differential execution (DumplingDiffOracle)
Nobody has claimed this yet.
- Dominant language
- Swift
- Stars
- 2.3k
- Forks
- 367
- Avg merge
- 23h 53m
- Merged PRs (30d)
- 1
Description
Summary
Fuzzilli crashes with a fatal error when the Dumpling differential oracle encounters an unknown frame type.
The crash happens in parseFrameType because a new/unknown frame prefix appeared in the dump that is not handled in the switch.
Crash Details
Fuzzilli/Oracle.swift:184: Fatal error: Unknown frame type
💣 Program crashed: Illegal instruction at 0x00007ad78b2e2af8
Platform: x86_64 Linux (Ubuntu 22.04.5 LTS)
Thread 5 crashed:
0 _assertionFailure(_:_:file:line:flags:) + 264 in libswiftCore.so
1 parseFrameType #1 (_:) in static DiffOracle.parseDiffFrame(_:_:_:_:) + 292
at Sources/Fuzzilli/DumplingDiffOracle/Oracle.swift:184:17
182│ case "---D": .deoptTurbofan
183│ default:
184│ fatalError("Unknown frame type")
│ ▲
185│ }
... (full backtrace continues through parseFullFrames → relate → DiffExecution.diff → executeDifferentialIfNeeded)
Backtrace key points:
DiffOracle.parseDiffFrameDiffOracle.parseFullFramesDiffOracle.relate(optIn:with:)DiffExecution.diff(...)Fuzzer.executeDifferentialIfNeeded→Fuzzer.execute→Fuzzer.importProgram
Actual Behavior
Hard fatalError → immediate crash of the fuzzer process.
Commit ID
cbade79edaf1dae0c233890b7957f560008d2c63
Environment
- Proxmox PVE Ubuntu 22.04 VM
- 60 cores
- 64 GB Ram
- 150gb nvme
Command Used:
swift run -c release FuzzilliCli --profile=v8Dumpling --jobs=60 --storagePath=/home/saqib/Desktop/dump --swarmTesting --forDifferentialFuzzing /home/{$USER}/Desktop/v8/out/fuzzbuild/d8
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in Sources/Fuzzilli/DumplingDiffOracle/Oracle.swift at parseDiffFrame and parseFrameType, then trace parseFullFrames and relate. Reproduce with the v8Dumpling differential-fuzzing command and inspect the unknown dump prefix; done means the encountered frame no longer causes an immediate fuzzer crash and its handling is validated.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- swift
- Domain
- testing-qa, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100