Place holder bug: V8 is reporting OOM in standalone build via "Allocation failed - JavaScript heap out of memory" |
||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5813335567630336 Fuzzer: mbarbella_js_mutation Job Type: linux_ubsan_vptr_d8 Platform Id: linux Crash Type: Fatal error Crash Address: Crash State: MarkCompactCollector: Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_vptr_d8&range=386994:387080 Minimized Testcase (0.18 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv963vhs49islRtzH7j_MNA3snumgJWVZz4hi81JyYwySFCvSqbTRusNvUT3BTJBLEfSJJcSqfQNJK5eDNW2Y2NfJygHfFSBSz-RAwsMt5IQjjw0XbStuQxweTjJAcV99p64I_mI9y0veElRrTooA46r_Ec59kg var __v_10 = {}; __v_8 = (function() { })(); function __f_8() { } function __f_9(n) { for (var __v_7 = -374503550; __v_7 < n; __v_7++) { __v_10 += ':'; } } __v_11 = __f_9(50000); Filer: manoranjanr See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Apr 26 2016
This is properly reporting an OOM situation via {i::V8::FatalProcessOutOfMemory} which will invoke any Chrome provided {FatalErrorCallback} when compiled into Chrome. For a standalone (i.e. "d8") build, we report it to the console as a safe crash with the message "Allocation failed - JavaScript heap out of memory". In short, this is working as intended.
I will keep this issue open on the triaging list for V8 ClusterFuzz issues as a place-holder for ClusterFuzz reports to be merged into. There is nothing actionable here.
,
Apr 26 2016
,
Apr 27 2016
,
Jun 8 2016
ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5813335567630336 Fuzzer: mbarbella_js_mutation Job Type: linux_ubsan_vptr_d8 Platform Id: linux Crash Type: Fatal error Crash Address: Crash State: MarkCompactCollector: Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_vptr_d8&range=386994:387080 Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96su2PBDM3nszHDghyxUwdZusg795j88LczmJgTvC_FNJOhJoxo2xjaz5dKbn6xu-MrksoCeJfpJMuJn9eGpZLMtoPhpgbotxy2jmfA1beabqU9UPS_UsL8Ug_bCoxU6xjDlGk-XJuw1l-Rifacocigoo21TA See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Dec 8 2016
As per Comment# 5, ClusterFuzz has detected the test case as potentially fixed, so changing the status to Fixed. Please undo if that is not the case. Thank You. |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by manoranj...@chromium.org
, Apr 25 2016Labels: Te-Logged