New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 601404 link

Starred by 0 users
Status: Verified
Owner:
u...@chromium.org
Closed: Jun 2016
Cc:
mlippautz@chromium.org
ishell@chromium.org
mstarzinger@chromium.org
u...@chromium.org
█ hpayer@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

obj->IsValidSlot(offset) in v8/src/heap/remembered-set.cc

Project Member Reported by ClusterFuzz, Apr 7 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6153012388560896

Fuzzer: stgao_chromebot2
Job Type: linux_asan_chrome_v8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  obj->IsValidSlot(offset) in v8/src/heap/remembered-set.cc
  [NUMBER:6135:0404/NUMBER:ERROR:cert_verify_proc_nss.cc(984)]
  <unknown>
  v8::base::OS::Abort
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv945ZiVifoSY1G3oE30k4LYxBfLWMiIqxh_Mv5uJ0puC_GSEdCOXHkmOqAkZQC7cJ8fSK7BOOplKqPDbCMiwv4IKvD-FKics3D66KfHxOSqRoKtvxMl9yJQemi1p_QiauF9Az0XXQU90u2HjShQZ3de7CvgsGwQMVJ7tBV8nrpLJiR9xOtA


Filer: ishell

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by ishell@chromium.org, Apr 7 2016

Cc: ishell@chromium.org mlippautz@chromium.org u...@chromium.org mstarzinger@chromium.org
Owner: u...@chromium.org

Comment 2 by ishell@chromium.org, Apr 7 2016

Status: Assigned (was: Available)

Comment 3 by ishell@chromium.org, Apr 7 2016

Components: Blink>JavaScript>GC
Project Member

Comment 4 by ClusterFuzz, Apr 7 2016 

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5372864328368128

Fuzzer: stgao_chromebot2
Job Type: linux_asan_chrome_v8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  obj->IsValidSlot(offset) in v8/src/heap/remembered-set.cc
  [NUMBER:28780:0404/NUMBER:ERROR:cert_verify_proc_nss.cc(984)]
  <unknown>
  v8::base::OS::Abort
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94kQHhUa7S9cH4G0BvhoYwQl1QjPL8B6XkMk3I0TYeOFeHVZnVYlw0CKdrUusdnNF21KZAt-7_AkIPLOOG99g-iSaBipjnD-BmwGoSXwuxJAn6vkalMb2qm2BQ1tSRng73xpE5TQhJJJRkIAphxuuogXsqNZ6QGIRT17tlrXRyJVFApfuQ


Filer: ishell

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Project Member

Comment 5 by ClusterFuzz, Apr 7 2016 

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6153012388560896

Fuzzer: stgao_chromebot2
Job Type: linux_asan_chrome_v8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  obj->IsValidSlot(offset) in v8/src/heap/remembered-set.cc
  [NUMBER:6135:0404/NUMBER:ERROR:cert_verify_proc_nss.cc(984)]
  <unknown>
  v8::base::OS::Abort
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv945ZiVifoSY1G3oE30k4LYxBfLWMiIqxh_Mv5uJ0puC_GSEdCOXHkmOqAkZQC7cJ8fSK7BOOplKqPDbCMiwv4IKvD-FKics3D66KfHxOSqRoKtvxMl9yJQemi1p_QiauF9Az0XXQU90u2HjShQZ3de7CvgsGwQMVJ7tBV8nrpLJiR9xOtA


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Apr 7 2016 

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6559840096223232

Fuzzer: stgao_chromebot2
Job Type: linux_asan_chrome_v8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  obj->IsValidSlot(offset) in v8/src/heap/remembered-set.cc
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv95zBnXm5RFm45dW3N68UfcxTRzPgR5L4eu474JK1EQG8JlcrP6yr4rZ7DrRaOypCKI6FKpgranpOcMqW8B2dUUedokc4BFN3bKeU0TaMrScuP9AktJmQ1kNKhnYckLfV913-KRnOx07ieXIEJ10sbmIo1bMhTy_wt__QDnl1IqDh37k5I0


Filer: ishell

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Project Member

Comment 7 by ClusterFuzz, Apr 7 2016 

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5188328063762432

Fuzzer: stgao_chromebot2
Job Type: linux_asan_chrome_v8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  obj->IsValidSlot(offset) in v8/src/heap/remembered-set.cc
  <unknown>
  v8::base::OS::Abort
  V8_Fatal
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96q1Nzn6ya5v-wj7lD5i6lu92GMn2KwKvrSjhuIQilYcDf3EvmoMa9Lkai3GiuYbmrByzV-5nHH29bCyRTW1ikDTz0q1KZUEhmR8aXj1HhXVUn4ZOFJBvL2up-7Ry2TSKlIfpZep7bhEW48SesqsiQtLrd76wQMw-tY0E830Y3DwuisjfI


Filer: ishell

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Project Member

Comment 8 by ClusterFuzz, Apr 7 2016 

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5101837748797440

Fuzzer: stgao_chromebot2
Job Type: linux_asan_chrome_v8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  obj->IsValidSlot(offset) in v8/src/heap/remembered-set.cc
  V8_Fatal
  _ZZN2v88internal13RememberedSetILNS0_16PointerDirectionE0EE16VerifyValidSlotsEPN
  _ZN2v88internal7SlotSet7IterateIZNS0_13RememberedSetILNS0_16PointerDirectionE0EE
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94dGy3oCfSSvCJzAf466Q0lOtUCRVkymhSY7b8rVzW-NyccQz0iP6cxEyjyHhViDayS8ZYPCK24r2zO9bUoR1VvMj8jYc8baxC6ui2UqI_wN3WPplRWQd08JFrYgwAMNejrM3YG10Sqqi6x6Yqp93vU1ZuwXtCiJR9qJ7G7oWCQPZarA2c


Filer: ishell

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 9 by u...@chromium.org, Apr 7 2016 

No luck with reproducing the crash so far even with the chrome binary provided in the report :-/
Project Member

Comment 10 by ClusterFuzz, Jun 2 2016 

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6559840096223232

Fuzzer: stgao_chromebot2
Job Type: linux_asan_chrome_v8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  obj->IsValidSlot(offset) in v8/src/heap/remembered-set.cc
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv95zBnXm5RFm45dW3N68UfcxTRzPgR5L4eu474JK1EQG8JlcrP6yr4rZ7DrRaOypCKI6FKpgranpOcMqW8B2dUUedokc4BFN3bKeU0TaMrScuP9AktJmQ1kNKhnYckLfV913-KRnOx07ieXIEJ10sbmIo1bMhTy_wt__QDnl1IqDh37k5I0


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by ClusterFuzz, Jun 2 2016 

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5372864328368128

Fuzzer: stgao_chromebot2
Job Type: linux_asan_chrome_v8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  obj->IsValidSlot(offset) in v8/src/heap/remembered-set.cc
  [NUMBER:28780:0404/NUMBER:ERROR:cert_verify_proc_nss.cc(984)]
  <unknown>
  v8::base::OS::Abort
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94kQHhUa7S9cH4G0BvhoYwQl1QjPL8B6XkMk3I0TYeOFeHVZnVYlw0CKdrUusdnNF21KZAt-7_AkIPLOOG99g-iSaBipjnD-BmwGoSXwuxJAn6vkalMb2qm2BQ1tSRng73xpE5TQhJJJRkIAphxuuogXsqNZ6QGIRT17tlrXRyJVFApfuQ


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 12 by ClusterFuzz, Jun 2 2016 

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5101837748797440

Fuzzer: stgao_chromebot2
Job Type: linux_asan_chrome_v8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  obj->IsValidSlot(offset) in v8/src/heap/remembered-set.cc
  V8_Fatal
  _ZZN2v88internal13RememberedSetILNS0_16PointerDirectionE0EE16VerifyValidSlotsEPN
  _ZN2v88internal7SlotSet7IterateIZNS0_13RememberedSetILNS0_16PointerDirectionE0EE
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94dGy3oCfSSvCJzAf466Q0lOtUCRVkymhSY7b8rVzW-NyccQz0iP6cxEyjyHhViDayS8ZYPCK24r2zO9bUoR1VvMj8jYc8baxC6ui2UqI_wN3WPplRWQd08JFrYgwAMNejrM3YG10Sqqi6x6Yqp93vU1ZuwXtCiJR9qJ7G7oWCQPZarA2c


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 13 by ClusterFuzz, Jun 2 2016 

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5188328063762432

Fuzzer: stgao_chromebot2
Job Type: linux_asan_chrome_v8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  obj->IsValidSlot(offset) in v8/src/heap/remembered-set.cc
  <unknown>
  v8::base::OS::Abort
  V8_Fatal
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96q1Nzn6ya5v-wj7lD5i6lu92GMn2KwKvrSjhuIQilYcDf3EvmoMa9Lkai3GiuYbmrByzV-5nHH29bCyRTW1ikDTz0q1KZUEhmR8aXj1HhXVUn4ZOFJBvL2up-7Ry2TSKlIfpZep7bhEW48SesqsiQtLrd76wQMw-tY0E830Y3DwuisjfI


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 14 by ClusterFuzz, Jun 13 2016

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 15 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment