RUNTIME_ASSERT in args[0]->IsJSFunction() in src/runtime/runtime-test.cc |
||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=4773273061031936 Fuzzer: mbarbella_js_mutation Job Type: linux_asan_d8_v8_arm_dbg Platform Id: linux Crash Type: RUNTIME_ASSERT Crash Address: Crash State: args[0]->IsJSFunction() in src/runtime/runtime-test.cc Regressed: V8: r34400:34401 Minimized Testcase (0.36 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94a2JKsJfVIW8o3yo5HdKVgfBTLOxrmuMJjoL5aEBSePkPrRCCAjwlkneDVLBSGnJcPYOFY7TEp1HUI6rTEe9hT9xjI1gxkhK4iAoPF5Vsyo4MOLAiL4NShf7H3JD9oUD5lBO2IuqyehQPbw77YsFhIeEUNTw Filer: hablich See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Apr 1 2016
In this test case, %GetOptimizationStatus is being called with the first argument as undefined, rather than a JSFunction, leading to a RUNTIME_ASSERT failure. mbarbella, this looks like a case of that kind of test infrastructure problem that you've been working on fiixng.
,
Apr 1 2016
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
||||
►
Sign in to add a comment |
||||
Comment 1 by mstarzinger@chromium.org
, Apr 1 2016Status: Assigned (was: Available)