Crash in v8::Context::Enter |
|||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5616366928789504 Fuzzer: lcamtuf_cross_fuzz Job Type: linux_asan_chrome_chromeos Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000000000 Crash State: v8::Context::Enter extensions::AppBindings::OnAppInstallStateResponse bool IPC::MessageT<ExtensionMsg_GetAppInstallStateResponse_Meta, std::tuple<std: Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_chromeos&range=385989:386017 Minimized Testcase (5.53 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95eHo4QoFxd8xTLxpUoY7y-1_-31qQAqtlJG9NBbR597U6YiP-vEsKjhgqoxJcEwT-3XpN6ttIYT716tueudZGPYd-inzPMk6E-znnegSuvKG_BGFTbknp4oFeEmx0CCes-Nb1QEfMWevmQGV83VuN2g8Fb-A Filer: tkonchada See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Apr 11 2016
Not V8 heap related.
,
Apr 12 2016
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4703304327626752 Fuzzer: lcamtuf_cross_fuzz Job Type: linux_lsan_chrome_mp Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000000000 Crash State: v8::Context::Enter extensions::AppBindings::OnAppInstallStateResponse bool IPC::MessageT<ExtensionMsg_GetAppInstallStateResponse_Meta, std::__1::tuple Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv965mpo9V5OkN9O4nIGF6CDST4GaNZ00wq8Sl2PtXXR3HoBvcMlihaGQvv5RUwrHZFFoOjqcOiinstD1pc-Odx-_9UwZOA6ogUgVOhXeC-BMVgOdPNWR49g7gh6hhmNydXqj2XXILldeL5XGu3OvSl2QeBApzk67S4_6DRK_yxb4-_eyT78 Additional requirements: Requires Gestures Filer: pucchakayala See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Apr 12 2016
Suspected CLs Regression information is not available. The result is the blame information. Author: bmeurer Project: chromium-v8 Changelist: https://chromium.googlesource.com/v8/v8.git/+/199e30d36fe8a360797b723ea19cbe106504dc43 Time: Wed Jul 15 11:05:00 2015 The CL last changed line 50 of file handles.h, which is stack frame 0. Author: bmeurer Project: chromium-v8 Changelist: https://chromium.googlesource.com/v8/v8.git/+/199e30d36fe8a360797b723ea19cbe106504dc43 Time: Wed Jul 15 11:05:00 2015 The CL last changed line 114 of file handles.h, which is stack frame 1. Author: bmeurer Project: chromium-v8 Changelist: https://chromium.googlesource.com/v8/v8.git/+/199e30d36fe8a360797b723ea19cbe106504dc43 Time: Wed Jul 15 11:05:00 2015 The CL last changed line 110 of file handles.h, which is stack frame 2. Author: vitalyr@chromium.org Project: chromium-v8 Changelist: https://chromium.googlesource.com/v8/v8.git/+/a07bd45c29378cde1a8bb20a3323fe9f63721665 Time: Tue Jun 07 13:09:01 2011 The CL last changed line 853 of file api.cc, which is stack frame 3. Author: dcarney@chromium.org Project: chromium-v8 Changelist: https://chromium.googlesource.com/v8/v8.git/+/cf5ff5a14cd677ff603b55ccf196e2913837008a Time: Thu May 02 20:18:42 2013 The CL last changed line 7077 of file v8.h, which is stack frame 4. Author: marja@chromium.org Project: chromium Changelist: https://chromium.googlesource.com/chromium/src//+/9a5984409f05752318c259fc1c69f0dba0107c07 Time: Tue Jun 04 16:39:12 2013 The CL last changed line 167 of file app_bindings.cc, which is stack frame 5. Author: mdempsky Project: chromium Changelist: https://chromium.googlesource.com/chromium/src//+/8a5190449d48e06efa581390426dfa3bb6750f4c Time: Tue Feb 09 05:41:47 2016 The CL last changed line 26 of file ipc_message_templates.h, which is stack frame 6. Suspected Project: chromium-v8 Suspected Component: Blink>JavaScript @mdempsky, can you please take a look at this issue ?
,
Apr 19 2016
ClusterFuzz has detected this issue as fixed in range 388139:388170. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5616366928789504 Fuzzer: lcamtuf_cross_fuzz Job Type: linux_asan_chrome_chromeos Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000000000 Crash State: v8::Context::Enter extensions::AppBindings::OnAppInstallStateResponse bool IPC::MessageT<ExtensionMsg_GetAppInstallStateResponse_Meta, std::tuple<std: Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_chromeos&range=385989:386017 Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_chromeos&range=388139:388170 Minimized Testcase (5.53 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95eHo4QoFxd8xTLxpUoY7y-1_-31qQAqtlJG9NBbR597U6YiP-vEsKjhgqoxJcEwT-3XpN6ttIYT716tueudZGPYd-inzPMk6E-znnegSuvKG_BGFTbknp4oFeEmx0CCes-Nb1QEfMWevmQGV83VuN2g8Fb-A See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Apr 19 2016
ClusterFuzz has detected this issue as fixed in range 388139:388170. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4703304327626752 Fuzzer: lcamtuf_cross_fuzz Job Type: linux_lsan_chrome_mp Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000000000 Crash State: v8::Context::Enter extensions::AppBindings::OnAppInstallStateResponse bool IPC::MessageT<ExtensionMsg_GetAppInstallStateResponse_Meta, std::__1::tuple Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=388139:388170 Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv965mpo9V5OkN9O4nIGF6CDST4GaNZ00wq8Sl2PtXXR3HoBvcMlihaGQvv5RUwrHZFFoOjqcOiinstD1pc-Odx-_9UwZOA6ogUgVOhXeC-BMVgOdPNWR49g7gh6hhmNydXqj2XXILldeL5XGu3OvSl2QeBApzk67S4_6DRK_yxb4-_eyT78 Additional requirements: Requires Gestures See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Apr 26 2016
Fixed according to clusterfuzz.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by tkonch...@chromium.org
, Apr 11 2016Labels: findit-for-crash Te-Logged M-51
Owner: mlippautz@chromium.org
Status: Assigned (was: Available)