New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 602973 link

Starred by 0 users

Issue metadata

Status: Verified
Owner:
Closed: Jun 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug



Sign in to add a comment

old_gen_size > 0 in v8/src/heap/heap.cc

Project Member Reported by ClusterFuzz, Apr 13 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5335767187980288

Fuzzer: jsbell_serviceworker
Job Type: windows_asan_chrome_no_sandbox
Platform Id: windows

Crash Type: CHECK failure
Crash Address: 
Crash State:
  old_gen_size > 0 in v8/src/heap/heap.cc
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_chrome_no_sandbox&range=379564:379959

Minimized Testcase (0.19 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv957TXVDpm4AnmW9cPjYt3KiPYY-NokV5ZNZjMqZT0iXbp-nGo2KEpcX_TKoT1xKyQ7MbSkvT1bGXvp3bcZge_cXwVKP6m-XmvVyMhkUzMarIFWXHaEeZq1TVL7A5b1LHROYPgWRk2UK0H0QHFw6k5yKCP2PRA
<script>
(function(instance) {
    (function() {
    }());
    var result = instance.register("", {scope: Array(66211047)});
  window.location.reload();
}(navigator.serviceWorker));
</script>


Filer: ishell

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 

Comment 1 by ishell@chromium.org, Apr 13 2016

Cc: mlippautz@chromium.org u...@chromium.org mstarzinger@chromium.org
Owner: hpayer@chromium.org
Status: Assigned (was: Available)

Comment 2 by hpayer@chromium.org, Apr 13 2016

Cc: hpayer@chromium.org
Owner: jarin@chromium.org
Hey Jaro, can you have a look?

Comment 3 by jarin@chromium.org, Apr 13 2016

This is an out-of-memory situation. It does not reproduce on my box with the same stack trace.

Comment 4 by jarin@chromium.org, Jun 9 2016

Labels: -Pri-1 Pri-2
Project Member

Comment 5 by ClusterFuzz, Jun 14 2016

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5335767187980288

Fuzzer: jsbell_serviceworker
Job Type: windows_asan_chrome_no_sandbox
Platform Id: windows

Crash Type: CHECK failure
Crash Address: 
Crash State:
  old_gen_size > 0 in heap.cc
  v8::internal::Heap::CollectGarbage
  v8::internal::Heap::HandleGCRequest
  v8::internal::Invoke
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_chrome_no_sandbox&range=379564:379959

Minimized Testcase (0.19 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96G6UMu5NNge7qnc34CY3m7E_8ArlslU6JS7pkJX2DTyFqBIAdQ1_HeefVZv_7yn-B5hn-8B8RFVmqeoa1taASagTrZeE6tQ9uyJJubAS9cfllkdS2ranhztREpjwmP8lU3WHW47jfPjStZB9fiklINLr_egQ
<script>
(function(instance) {
    (function() {
    }());
    var result = instance.register("", {scope: Array(66211047)});
  window.location.reload();
}(navigator.serviceWorker));
</script>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Jun 14 2016

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 7 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment