New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 604375 link

Starred by 0 users

Issue metadata

Status: Fixed
Owner:
Closed: Apr 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in v8::internal::FunctionLiteral::start_position

Project Member Reported by ClusterFuzz, Apr 18 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4834949550571520

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000030
Crash State:
  v8::internal::FunctionLiteral::start_position
  v8::internal::CodeGenerator::PrintCode
  v8::internal::compiler::Pipeline::ScheduleAndGenerateCode
  
Regressed: V8: r35566:35567

Minimized Testcase (0.01 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96MzQECoeLrErVbEmPshSpr_8bpOBo4A6rlSM5S1Q_IiIj-7s9W9VlZTfoZegDIMRmzD0JXCA8F_fZbvtPI6ekAUECBXgz0u7SNoCo7hvsYsnE6YTVved7IG0mdyC-v-2g_2TgopiwK3uegYvejcvBcV0hL4w
 gc = nop; 


Filer: mstarzinger

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Owner: mstarzinger@chromium.org
Status: Assigned (was: Available)
This is mine. Reproduces as follows ...

$ ./out/ia32.debug/d8 --ignition --always-opt --print-code -e "x"
Project Member

Comment 2 by bugdroid1@chromium.org, Apr 18 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/8c6f18aa04310752f1f39669ef26531af42b1959

commit 8c6f18aa04310752f1f39669ef26531af42b1959
Author: mstarzinger <mstarzinger@chromium.org>
Date: Mon Apr 18 16:04:56 2016

[compiler] Workaround in code printing without literal.

R=ishell@chromium.org
BUG= chromium:604375 
LOG=n

Review URL: https://codereview.chromium.org/1895073002

Cr-Commit-Position: refs/heads/master@{#35588}

[modify] https://crrev.com/8c6f18aa04310752f1f39669ef26531af42b1959/src/codegen.cc

Project Member

Comment 3 by ClusterFuzz, Apr 18 2016

ClusterFuzz has detected this issue as fixed in range 35587:35588.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4834949550571520

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000030
Crash State:
  v8::internal::FunctionLiteral::start_position
  v8::internal::CodeGenerator::PrintCode
  v8::internal::compiler::Pipeline::ScheduleAndGenerateCode
  
Regressed: V8: r35566:35567
Fixed: V8: r35587:35588

Minimized Testcase (0.01 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96MzQECoeLrErVbEmPshSpr_8bpOBo4A6rlSM5S1Q_IiIj-7s9W9VlZTfoZegDIMRmzD0JXCA8F_fZbvtPI6ekAUECBXgz0u7SNoCo7hvsYsnE6YTVved7IG0mdyC-v-2g_2TgopiwK3uegYvejcvBcV0hL4w
 gc = nop; 


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Status: Fixed (was: Assigned)
Project Member

Comment 5 by bugdroid1@chromium.org, Apr 19 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/489d751efd8f631d4149b95ad7ff71a24d39e0c9

commit 489d751efd8f631d4149b95ad7ff71a24d39e0c9
Author: mstarzinger <mstarzinger@chromium.org>
Date: Tue Apr 19 07:59:37 2016

[compiler] Switch code printing to not use literal.

This switches CodeGenerator::PrintCode to be based on the allocated
shared function info instead of the function literal. This is possible
now that even live edit allocates a shared function info for scripts.

R=ishell@chromium.org
BUG= chromium:604375 
LOG=n

Review URL: https://codereview.chromium.org/1901753002

Cr-Commit-Position: refs/heads/master@{#35605}

[modify] https://crrev.com/489d751efd8f631d4149b95ad7ff71a24d39e0c9/src/codegen.cc

Project Member

Comment 6 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment