New issue
Advanced search Search tips

Issue 598998 link

Starred by 0 users

Issue metadata

Status: Fixed
Owner:
Closed: Apr 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

output_count_ - 1 != frame_index in src/deoptimizer.cc

Project Member Reported by ClusterFuzz, Mar 30 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6464973873610752

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  output_count_ - 1 != frame_index in src/deoptimizer.cc
  
Regressed: V8: r34991:34992

Minimized Testcase (11.50 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94GX59EdK5thr41V1QwxN1jrP-GxY54icAqbcGqhScj9aOhgBrmg-Dzhx0DjpQEEsvciVhHBOUuKQkNG2DxqMa8joFcvL8KPihzsZNxPFzZdLX0rCF9NfZ-Xl7TE9L9yaDel1hiXd9TKkfq8V76EjKp0BRWoA

Filer: hablich

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Owner: ishell@chromium.org
Status: Assigned (was: Available)
Project Member

Comment 2 by bugdroid1@chromium.org, Apr 1 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4

commit ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4
Author: ishell <ishell@chromium.org>
Date: Fri Apr 01 07:22:22 2016

[crankshaft] [turbofan] Fix environment handling when generating a tail call from inlined function.

This CL ensures that we build environments/frame states so that tail caller frame will never become topmost.

BUG= chromium:598998 , v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1849503002

Cr-Commit-Position: refs/heads/master@{#35188}

[modify] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/src/compiler/instruction-selector.cc
[modify] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/src/crankshaft/arm/lithium-arm.cc
[modify] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/src/crankshaft/arm64/lithium-arm64.cc
[modify] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/src/crankshaft/ia32/lithium-ia32.cc
[modify] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/src/crankshaft/mips/lithium-mips.cc
[modify] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/src/crankshaft/mips64/lithium-mips64.cc
[modify] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/src/crankshaft/ppc/lithium-ppc.cc
[modify] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/src/crankshaft/s390/lithium-s390.cc
[modify] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/src/crankshaft/x64/lithium-x64.cc
[modify] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/src/crankshaft/x87/lithium-x87.cc
[add] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/test/mjsunit/regress/regress-crbug-598998.js

Status: Fixed (was: Assigned)
Project Member

Comment 4 by ClusterFuzz, Apr 6 2016

ClusterFuzz has detected this issue as fixed in range 35252:35253.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6464973873610752

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  output_count_ - 1 != frame_index in src/deoptimizer.cc
  
Regressed: V8: r34991:34992
Fixed: V8: r35252:35253

Minimized Testcase (11.50 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94GX59EdK5thr41V1QwxN1jrP-GxY54icAqbcGqhScj9aOhgBrmg-Dzhx0DjpQEEsvciVhHBOUuKQkNG2DxqMa8joFcvL8KPihzsZNxPFzZdLX0rCF9NfZ-Xl7TE9L9yaDel1hiXd9TKkfq8V76EjKp0BRWoA

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment