New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 606492 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner: ----
Closed: Dec 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug



Sign in to add a comment

Place holder bug: V8 is reporting OOM in standalone build via "Allocation failed - JavaScript heap out of memory"

Project Member Reported by ClusterFuzz, Apr 25 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5813335567630336

Fuzzer: mbarbella_js_mutation
Job Type: linux_ubsan_vptr_d8
Platform Id: linux

Crash Type: Fatal error
Crash Address: 
Crash State:
  MarkCompactCollector:
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_vptr_d8&range=386994:387080

Minimized Testcase (0.18 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv963vhs49islRtzH7j_MNA3snumgJWVZz4hi81JyYwySFCvSqbTRusNvUT3BTJBLEfSJJcSqfQNJK5eDNW2Y2NfJygHfFSBSz-RAwsMt5IQjjw0XbStuQxweTjJAcV99p64I_mI9y0veElRrTooA46r_Ec59kg
var __v_10 = {};
__v_8 = (function() {
})();
function __f_8() {
}
function __f_9(n) {
  for (var __v_7 = -374503550; __v_7 < n; __v_7++) {
     __v_10 += ':';
  }
}
__v_11 = __f_9(50000);


Filer: manoranjanr

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: ishell@chromium.org mstarzinger@chromium.org
Labels: Te-Logged
Summary: Place holder bug: V8 is reporting OOM in standalone build via "Allocation failed - JavaScript heap out of memory" (was: Fatal error in MarkCompactCollector:)
This is properly reporting an OOM situation via {i::V8::FatalProcessOutOfMemory} which will invoke any Chrome provided {FatalErrorCallback} when compiled into Chrome. For a standalone (i.e. "d8") build, we report it to the console as a safe crash with the message "Allocation failed - JavaScript heap out of memory". In short, this is working as intended.

I will keep this issue open on the triaging list for V8 ClusterFuzz issues as a place-holder for ClusterFuzz reports to be merged into. There is nothing actionable here.
Components: Blink>JavaScript
Labels: -OS-Linux -Pri-1 Pri-3
Project Member

Comment 5 by ClusterFuzz, Jun 8 2016

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5813335567630336

Fuzzer: mbarbella_js_mutation
Job Type: linux_ubsan_vptr_d8
Platform Id: linux

Crash Type: Fatal error
Crash Address: 
Crash State:
  MarkCompactCollector:
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_vptr_d8&range=386994:387080

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96su2PBDM3nszHDghyxUwdZusg795j88LczmJgTvC_FNJOhJoxo2xjaz5dKbn6xu-MrksoCeJfpJMuJn9eGpZLMtoPhpgbotxy2jmfA1beabqU9UPS_UsL8Ug_bCoxU6xjDlGk-XJuw1l-Rifacocigoo21TA


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Cc: msrchandra@chromium.org
Status: Fixed (was: Available)
As per Comment# 5, ClusterFuzz has detected the test case as potentially fixed, so changing the status to Fixed.
Please undo if that is not the case.
Thank You.

Sign in to add a comment