AllowHandleAllocation::IsAllowed() in src/heap/heap-inl.h |
||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5692828894363648 Fuzzer: mbarbella_js_mutation Job Type: linux_asan_d8_ignition_dbg Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: AllowHandleAllocation::IsAllowed() in src/heap/heap-inl.h Regressed: V8: r36206:36207 Minimized Testcase (0.36 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv95-DnL4FBFMKrSH0xaXOE1Dyvh6BOVzqAuEl-0QaN904yjoBA6aH9UGUy9Y0V-ocZrAijAjXiIGoSYn3zyINq9FVcN5Epq137SvoAUF9PHFG1ngPVPC_Jz5bDJw0OMzKa9aSCY0ToqRwYJLZaQExJphEJE7Vw function __f_55(expected, __f_70, __f_8) { Wasm.instantiateModuleFromAsm( __f_70.toString()); } function __f_18() { "use asm"; function __f_40(__v_22, __v_24) { __v_22 = __v_22|0; __v_24 = __v_24|0; var __v_23 = (__v_24 + 1)|0 __v_26 = __v_22; var __v_26 = 3.0; } function __f_19() { } return {__f_19: __f_19}; } __f_55(101,__f_18); Filer: mstarzinger See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
May 24 2016
,
May 25 2016
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/f768e53cd8e20fa5e24a096b9a443940d8968cf1 commit f768e53cd8e20fa5e24a096b9a443940d8968cf1 Author: ahaas <ahaas@chromium.org> Date: Wed May 25 09:26:28 2016 [wasm] Do not try start linking if the compilation failed. BUG= chromium:614291 LOG=N R=titzer@chromium.org, bradnelson@chromium.org Review-Url: https://codereview.chromium.org/2009823002 Cr-Commit-Position: refs/heads/master@{#36503} [modify] https://crrev.com/f768e53cd8e20fa5e24a096b9a443940d8968cf1/src/wasm/wasm-module.cc
,
May 25 2016
ClusterFuzz has detected this issue as fixed in range 36514:36515. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5692828894363648 Fuzzer: mbarbella_js_mutation Job Type: linux_asan_d8_ignition_dbg Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: AllowHandleAllocation::IsAllowed() in src/heap/heap-inl.h Regressed: V8: r36206:36207 Fixed: V8: r36514:36515 Minimized Testcase (0.36 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv95-DnL4FBFMKrSH0xaXOE1Dyvh6BOVzqAuEl-0QaN904yjoBA6aH9UGUy9Y0V-ocZrAijAjXiIGoSYn3zyINq9FVcN5Epq137SvoAUF9PHFG1ngPVPC_Jz5bDJw0OMzKa9aSCY0ToqRwYJLZaQExJphEJE7Vw function __f_55(expected, __f_70, __f_8) { Wasm.instantiateModuleFromAsm( __f_70.toString()); } function __f_18() { "use asm"; function __f_40(__v_22, __v_24) { __v_22 = __v_22|0; __v_24 = __v_24|0; var __v_23 = (__v_24 + 1)|0 __v_26 = __v_22; var __v_26 = 3.0; } function __f_19() { } return {__f_19: __f_19}; } __f_55(101,__f_18); See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
May 27 2016
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
||||
►
Sign in to add a comment |
||||
Comment 1 by mstarzinger@chromium.org
, May 24 2016Owner: ahaas@chromium.org
Status: Assigned (was: Available)