New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 619878 link

Starred by 1 user
Status: Fixed
Owner: ----
Closed: Aug 2016
Cc:
nyerramilli@chromium.org
█ mummare...@chromium.org
█ rossberg@chromium.org
ishell@chromium.org
mstarzinger@chromium.org
█ durga.behera@chromium.org
lfg@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Crash in v8::internal::JSObject::AddDataElement

Project Member Reported by ClusterFuzz, Jun 14 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6628621276151808

Fuzzer: mbarbella_webgl
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000
Crash State:
  v8::internal::JSObject::AddDataElement
  v8::internal::Object::AddDataProperty
  v8::internal::Object::SetProperty
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=375259:376290

Minimized Testcase (0.41 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94qNxcoLsIUMq_gSebS9_yujc9DaNo3tlFdWXZx6nP9NgexT-FoOz6gi2pZ252O2VFHJwQwKGq_nHJdgVImtXpkt1jtKhFmlz47o58c8MTSK53QyMsk9Ri8r3Vn0dX0_hNUsT8VgMJ7TEnsphgfQP3rWmQEhQ
<script>
      function create_program() {
      }
      function runTests() {
          var canvas = document.createElement('canvas');
          var gl = canvas.getContext('experimental-webgl');
          runTest(gl);
      }
function runTest(gl) {
try { runTest(gl) } catch(e) {; }
try { var buffer = gl.createBuffer() } catch(e) {; }
 gl.bindBuffer(gl.ARRAY_BUFFER, buffer) 
}
</script>
<body onload="runTests()">


Filer: durga.behera

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by durga.behera@chromium.org, Jun 14 2016

Components: Blink>JavaScript
Labels: Te-Logged M-52
Suspected CLs:
===============
The result is a list of CLs that change the crashed files.

Author: verwaest
Project: chromium-v8
Changelist: https://chromium.googlesource.com/v8/v8.git/+/7b59e3d7cbfe47eef4d28d41bcc2768b2b2b3678
Time: Tue Feb 16 09:52:44 2016
Lines 4609 of file objects.cc which potentially caused crash are changed in this cl (frame #4, "v8::internal::Object::AddDataProperty").
Minimum distance from crash line to modified line: 0. (file: objects.cc, crashed on: 4609, modified: 4609).

Suspected Project: chromium-v8
Suspected Component: Blink>JavaScript
Project Member

Comment 2 by sheriffbot@chromium.org, Jun 14 2016

Labels: -M-52 M-53 MovedFrom-52
Moving this nonessential bug to the next milestone.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 3 by mummare...@chromium.org, Jun 16 2016

Owner: verwa...@chromium.org
Status: Assigned (was: Available)
As per update#1, assigning this bug to verwaest@. could you please take a look and reassign if it is not related your changes.

Thank you.

Comment 4 by verwa...@chromium.org, Jun 21 2016

Components: -Blink>JavaScript Blink>WebGL
Owner: mummare...@chromium.org
Status: Available (was: Assigned)
This seems like a bug in blink/WebGL bindings that do not properly handle boundary conditions. We're obviously running out-of-stack here, and V8 gets an empty handle in as result a little later.

Comment 5 by kbr@chromium.org, Jun 21 2016

Components: Blink>Bindings
This looks more like a problem in the bindings than a WebGL-specific problem.
Project Member

Comment 6 by sheriffbot@chromium.org, Jul 5 2016

Labels: -M-53 -Pri-1 M-54 MovedFrom-53 Pri-2
This issue is Pri-1 but has already been moved once. Lowering the priority and moving to the next milestone.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 7 by ClusterFuzz, Jul 12 2016 

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5703690904403968

Fuzzer: inferno_twister
Job Type: windows_syzyasan_content_shell
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x00000003
Crash State:
  v8::internal::JSObject::AddDataElement
  v8::internal::Object::AddDataProperty
  v8::internal::Object::SetProperty
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_syzyasan_content_shell&range=403457:403667

Minimized Testcase (0.31 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96lrLHVNCwbtbUVfRTI9ejAReqSLxGWPG2XgliHmiRY8pjur36sbYWR3eqtXIwpv4JFbEHALeqm8hsas79DQEpHQKvapq-QyTGYCD3Ttqs7vPtKvCFzhfLWpIxyZwMff1UtRQU613Nq5Cqeuac8TeLQmF86ew?testcase_id=5703690904403968
<script>
      
          var canvas = document.createElement('canvas');
          var gl = canvas.getContext('experimental-webgl');
          runTest(gl);
function runTest() {
try { runTest() } catch(e) {; }
 var vertexBuffer = gl.createBuffer() 
 gl.bindBuffer(gl.ARRAY_BUFFER, vertexBuffer) 
}
</script>


Additional requirements: Requires HTTP

Filer: nyerramilli

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 8 by mummare...@chromium.org, Jul 12 2016

Cc: ishell@chromium.org mstarzinger@chromium.org rossberg@chromium.org mummare...@chromium.org nyerramilli@chromium.org durga.behera@chromium.org
Owner: ----

Comment 9 by kbr@chromium.org, Jul 12 2016 

Not a useful bug report. This is a basic stack overflow.
Project Member

Comment 10 by ClusterFuzz, Aug 8 2016 

ClusterFuzz has detected this issue as fixed in range 409589:409828.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6628621276151808

Fuzzer: mbarbella_webgl
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000
Crash State:
  v8::internal::JSObject::AddDataElement
  v8::internal::Object::AddDataProperty
  v8::internal::Object::SetProperty
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=393646:393766
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=409589:409828

Minimized Testcase (0.41 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94qNxcoLsIUMq_gSebS9_yujc9DaNo3tlFdWXZx6nP9NgexT-FoOz6gi2pZ252O2VFHJwQwKGq_nHJdgVImtXpkt1jtKhFmlz47o58c8MTSK53QyMsk9Ri8r3Vn0dX0_hNUsT8VgMJ7TEnsphgfQP3rWmQEhQ?testcase_id=6628621276151808
<script>
      function create_program() {
      }
      function runTests() {
          var canvas = document.createElement('canvas');
          var gl = canvas.getContext('experimental-webgl');
          runTest(gl);
      }
function runTest(gl) {
try { runTest(gl) } catch(e) {; }
try { var buffer = gl.createBuffer() } catch(e) {; }
 gl.bindBuffer(gl.ARRAY_BUFFER, buffer) 
}
</script>
<body onload="runTests()">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by ClusterFuzz, Aug 8 2016 

ClusterFuzz has detected this issue as fixed in range 409589:409828.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6628621276151808

Fuzzer: mbarbella_webgl
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000
Crash State:
  v8::internal::JSObject::AddDataElement
  v8::internal::Object::AddDataProperty
  v8::internal::Object::SetProperty
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=393646:393766
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=409589:409828

Minimized Testcase (0.41 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94qNxcoLsIUMq_gSebS9_yujc9DaNo3tlFdWXZx6nP9NgexT-FoOz6gi2pZ252O2VFHJwQwKGq_nHJdgVImtXpkt1jtKhFmlz47o58c8MTSK53QyMsk9Ri8r3Vn0dX0_hNUsT8VgMJ7TEnsphgfQP3rWmQEhQ?testcase_id=6628621276151808
<script>
      function create_program() {
      }
      function runTests() {
          var canvas = document.createElement('canvas');
          var gl = canvas.getContext('experimental-webgl');
          runTest(gl);
      }
function runTest(gl) {
try { runTest(gl) } catch(e) {; }
try { var buffer = gl.createBuffer() } catch(e) {; }
 gl.bindBuffer(gl.ARRAY_BUFFER, buffer) 
}
</script>
<body onload="runTests()">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 12 by ClusterFuzz, Aug 8 2016 

ClusterFuzz has detected this issue as fixed in range 409589:409828.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6628621276151808

Fuzzer: mbarbella_webgl
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000
Crash State:
  v8::internal::JSObject::AddDataElement
  v8::internal::Object::AddDataProperty
  v8::internal::Object::SetProperty
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=393646:393766
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=409589:409828

Minimized Testcase (0.41 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94qNxcoLsIUMq_gSebS9_yujc9DaNo3tlFdWXZx6nP9NgexT-FoOz6gi2pZ252O2VFHJwQwKGq_nHJdgVImtXpkt1jtKhFmlz47o58c8MTSK53QyMsk9Ri8r3Vn0dX0_hNUsT8VgMJ7TEnsphgfQP3rWmQEhQ?testcase_id=6628621276151808
<script>
      function create_program() {
      }
      function runTests() {
          var canvas = document.createElement('canvas');
          var gl = canvas.getContext('experimental-webgl');
          runTest(gl);
      }
function runTest(gl) {
try { runTest(gl) } catch(e) {; }
try { var buffer = gl.createBuffer() } catch(e) {; }
 gl.bindBuffer(gl.ARRAY_BUFFER, buffer) 
}
</script>
<body onload="runTests()">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 13 by ClusterFuzz, Aug 8 2016 

ClusterFuzz has detected this issue as fixed in range 409589:409828.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6628621276151808

Fuzzer: mbarbella_webgl
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000
Crash State:
  v8::internal::JSObject::AddDataElement
  v8::internal::Object::AddDataProperty
  v8::internal::Object::SetProperty
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=393646:393766
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=409589:409828

Minimized Testcase (0.41 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94qNxcoLsIUMq_gSebS9_yujc9DaNo3tlFdWXZx6nP9NgexT-FoOz6gi2pZ252O2VFHJwQwKGq_nHJdgVImtXpkt1jtKhFmlz47o58c8MTSK53QyMsk9Ri8r3Vn0dX0_hNUsT8VgMJ7TEnsphgfQP3rWmQEhQ?testcase_id=6628621276151808
<script>
      function create_program() {
      }
      function runTests() {
          var canvas = document.createElement('canvas');
          var gl = canvas.getContext('experimental-webgl');
          runTest(gl);
      }
function runTest(gl) {
try { runTest(gl) } catch(e) {; }
try { var buffer = gl.createBuffer() } catch(e) {; }
 gl.bindBuffer(gl.ARRAY_BUFFER, buffer) 
}
</script>
<body onload="runTests()">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 14 by ClusterFuzz, Aug 8 2016 

ClusterFuzz has detected this issue as fixed in range 409589:409828.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6628621276151808

Fuzzer: mbarbella_webgl
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000
Crash State:
  v8::internal::JSObject::AddDataElement
  v8::internal::Object::AddDataProperty
  v8::internal::Object::SetProperty
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=393646:393766
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=409589:409828

Minimized Testcase (0.41 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94qNxcoLsIUMq_gSebS9_yujc9DaNo3tlFdWXZx6nP9NgexT-FoOz6gi2pZ252O2VFHJwQwKGq_nHJdgVImtXpkt1jtKhFmlz47o58c8MTSK53QyMsk9Ri8r3Vn0dX0_hNUsT8VgMJ7TEnsphgfQP3rWmQEhQ?testcase_id=6628621276151808
<script>
      function create_program() {
      }
      function runTests() {
          var canvas = document.createElement('canvas');
          var gl = canvas.getContext('experimental-webgl');
          runTest(gl);
      }
function runTest(gl) {
try { runTest(gl) } catch(e) {; }
try { var buffer = gl.createBuffer() } catch(e) {; }
 gl.bindBuffer(gl.ARRAY_BUFFER, buffer) 
}
</script>
<body onload="runTests()">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 15 by ClusterFuzz, Aug 8 2016 

ClusterFuzz has detected this issue as fixed in range 409589:409828.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6628621276151808

Fuzzer: mbarbella_webgl
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000
Crash State:
  v8::internal::JSObject::AddDataElement
  v8::internal::Object::AddDataProperty
  v8::internal::Object::SetProperty
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=393646:393766
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=409589:409828

Minimized Testcase (0.41 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94qNxcoLsIUMq_gSebS9_yujc9DaNo3tlFdWXZx6nP9NgexT-FoOz6gi2pZ252O2VFHJwQwKGq_nHJdgVImtXpkt1jtKhFmlz47o58c8MTSK53QyMsk9Ri8r3Vn0dX0_hNUsT8VgMJ7TEnsphgfQP3rWmQEhQ?testcase_id=6628621276151808
<script>
      function create_program() {
      }
      function runTests() {
          var canvas = document.createElement('canvas');
          var gl = canvas.getContext('experimental-webgl');
          runTest(gl);
      }
function runTest(gl) {
try { runTest(gl) } catch(e) {; }
try { var buffer = gl.createBuffer() } catch(e) {; }
 gl.bindBuffer(gl.ARRAY_BUFFER, buffer) 
}
</script>
<body onload="runTests()">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 16 by ClusterFuzz, Aug 8 2016 

ClusterFuzz has detected this issue as fixed in range 409589:409828.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6628621276151808

Fuzzer: mbarbella_webgl
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000
Crash State:
  v8::internal::JSObject::AddDataElement
  v8::internal::Object::AddDataProperty
  v8::internal::Object::SetProperty
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=393646:393766
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=409589:409828

Minimized Testcase (0.41 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94qNxcoLsIUMq_gSebS9_yujc9DaNo3tlFdWXZx6nP9NgexT-FoOz6gi2pZ252O2VFHJwQwKGq_nHJdgVImtXpkt1jtKhFmlz47o58c8MTSK53QyMsk9Ri8r3Vn0dX0_hNUsT8VgMJ7TEnsphgfQP3rWmQEhQ?testcase_id=6628621276151808
<script>
      function create_program() {
      }
      function runTests() {
          var canvas = document.createElement('canvas');
          var gl = canvas.getContext('experimental-webgl');
          runTest(gl);
      }
function runTest(gl) {
try { runTest(gl) } catch(e) {; }
try { var buffer = gl.createBuffer() } catch(e) {; }
 gl.bindBuffer(gl.ARRAY_BUFFER, buffer) 
}
</script>
<body onload="runTests()">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 17 by ClusterFuzz, Aug 8 2016 

ClusterFuzz has detected this issue as fixed in range 409589:409828.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6628621276151808

Fuzzer: mbarbella_webgl
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000
Crash State:
  v8::internal::JSObject::AddDataElement
  v8::internal::Object::AddDataProperty
  v8::internal::Object::SetProperty
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=393646:393766
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=409589:409828

Minimized Testcase (0.41 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94qNxcoLsIUMq_gSebS9_yujc9DaNo3tlFdWXZx6nP9NgexT-FoOz6gi2pZ252O2VFHJwQwKGq_nHJdgVImtXpkt1jtKhFmlz47o58c8MTSK53QyMsk9Ri8r3Vn0dX0_hNUsT8VgMJ7TEnsphgfQP3rWmQEhQ?testcase_id=6628621276151808
<script>
      function create_program() {
      }
      function runTests() {
          var canvas = document.createElement('canvas');
          var gl = canvas.getContext('experimental-webgl');
          runTest(gl);
      }
function runTest(gl) {
try { runTest(gl) } catch(e) {; }
try { var buffer = gl.createBuffer() } catch(e) {; }
 gl.bindBuffer(gl.ARRAY_BUFFER, buffer) 
}
</script>
<body onload="runTests()">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 18 by ClusterFuzz, Aug 8 2016 

ClusterFuzz has detected this issue as fixed in range 409589:409828.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6628621276151808

Fuzzer: mbarbella_webgl
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000
Crash State:
  v8::internal::JSObject::AddDataElement
  v8::internal::Object::AddDataProperty
  v8::internal::Object::SetProperty
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=393646:393766
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=409589:409828

Minimized Testcase (0.41 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94qNxcoLsIUMq_gSebS9_yujc9DaNo3tlFdWXZx6nP9NgexT-FoOz6gi2pZ252O2VFHJwQwKGq_nHJdgVImtXpkt1jtKhFmlz47o58c8MTSK53QyMsk9Ri8r3Vn0dX0_hNUsT8VgMJ7TEnsphgfQP3rWmQEhQ?testcase_id=6628621276151808
<script>
      function create_program() {
      }
      function runTests() {
          var canvas = document.createElement('canvas');
          var gl = canvas.getContext('experimental-webgl');
          runTest(gl);
      }
function runTest(gl) {
try { runTest(gl) } catch(e) {; }
try { var buffer = gl.createBuffer() } catch(e) {; }
 gl.bindBuffer(gl.ARRAY_BUFFER, buffer) 
}
</script>
<body onload="runTests()">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 19 by ClusterFuzz, Aug 8 2016 

ClusterFuzz has detected this issue as fixed in range 409589:409828.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6628621276151808

Fuzzer: mbarbella_webgl
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000
Crash State:
  v8::internal::JSObject::AddDataElement
  v8::internal::Object::AddDataProperty
  v8::internal::Object::SetProperty
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=393646:393766
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=409589:409828

Minimized Testcase (0.41 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94qNxcoLsIUMq_gSebS9_yujc9DaNo3tlFdWXZx6nP9NgexT-FoOz6gi2pZ252O2VFHJwQwKGq_nHJdgVImtXpkt1jtKhFmlz47o58c8MTSK53QyMsk9Ri8r3Vn0dX0_hNUsT8VgMJ7TEnsphgfQP3rWmQEhQ?testcase_id=6628621276151808
<script>
      function create_program() {
      }
      function runTests() {
          var canvas = document.createElement('canvas');
          var gl = canvas.getContext('experimental-webgl');
          runTest(gl);
      }
function runTest(gl) {
try { runTest(gl) } catch(e) {; }
try { var buffer = gl.createBuffer() } catch(e) {; }
 gl.bindBuffer(gl.ARRAY_BUFFER, buffer) 
}
</script>
<body onload="runTests()">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 20 by ClusterFuzz, Aug 8 2016 

ClusterFuzz has detected this issue as fixed in range 409589:409828.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6628621276151808

Fuzzer: mbarbella_webgl
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000
Crash State:
  v8::internal::JSObject::AddDataElement
  v8::internal::Object::AddDataProperty
  v8::internal::Object::SetProperty
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=393646:393766
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=409589:409828

Minimized Testcase (0.41 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94qNxcoLsIUMq_gSebS9_yujc9DaNo3tlFdWXZx6nP9NgexT-FoOz6gi2pZ252O2VFHJwQwKGq_nHJdgVImtXpkt1jtKhFmlz47o58c8MTSK53QyMsk9Ri8r3Vn0dX0_hNUsT8VgMJ7TEnsphgfQP3rWmQEhQ?testcase_id=6628621276151808
<script>
      function create_program() {
      }
      function runTests() {
          var canvas = document.createElement('canvas');
          var gl = canvas.getContext('experimental-webgl');
          runTest(gl);
      }
function runTest(gl) {
try { runTest(gl) } catch(e) {; }
try { var buffer = gl.createBuffer() } catch(e) {; }
 gl.bindBuffer(gl.ARRAY_BUFFER, buffer) 
}
</script>
<body onload="runTests()">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 21 by ClusterFuzz, Aug 8 2016 

ClusterFuzz has detected this issue as fixed in range 409589:409828.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6628621276151808

Fuzzer: mbarbella_webgl
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000
Crash State:
  v8::internal::JSObject::AddDataElement
  v8::internal::Object::AddDataProperty
  v8::internal::Object::SetProperty
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=393646:393766
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=409589:409828

Minimized Testcase (0.41 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94qNxcoLsIUMq_gSebS9_yujc9DaNo3tlFdWXZx6nP9NgexT-FoOz6gi2pZ252O2VFHJwQwKGq_nHJdgVImtXpkt1jtKhFmlz47o58c8MTSK53QyMsk9Ri8r3Vn0dX0_hNUsT8VgMJ7TEnsphgfQP3rWmQEhQ?testcase_id=6628621276151808
<script>
      function create_program() {
      }
      function runTests() {
          var canvas = document.createElement('canvas');
          var gl = canvas.getContext('experimental-webgl');
          runTest(gl);
      }
function runTest(gl) {
try { runTest(gl) } catch(e) {; }
try { var buffer = gl.createBuffer() } catch(e) {; }
 gl.bindBuffer(gl.ARRAY_BUFFER, buffer) 
}
</script>
<body onload="runTests()">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 22 by ClusterFuzz, Aug 8 2016 

ClusterFuzz has detected this issue as fixed in range 409589:409828.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6628621276151808

Fuzzer: mbarbella_webgl
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000
Crash State:
  v8::internal::JSObject::AddDataElement
  v8::internal::Object::AddDataProperty
  v8::internal::Object::SetProperty
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=393646:393766
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=409589:409828

Minimized Testcase (0.41 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94qNxcoLsIUMq_gSebS9_yujc9DaNo3tlFdWXZx6nP9NgexT-FoOz6gi2pZ252O2VFHJwQwKGq_nHJdgVImtXpkt1jtKhFmlz47o58c8MTSK53QyMsk9Ri8r3Vn0dX0_hNUsT8VgMJ7TEnsphgfQP3rWmQEhQ?testcase_id=6628621276151808
<script>
      function create_program() {
      }
      function runTests() {
          var canvas = document.createElement('canvas');
          var gl = canvas.getContext('experimental-webgl');
          runTest(gl);
      }
function runTest(gl) {
try { runTest(gl) } catch(e) {; }
try { var buffer = gl.createBuffer() } catch(e) {; }
 gl.bindBuffer(gl.ARRAY_BUFFER, buffer) 
}
</script>
<body onload="runTests()">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 23 by ClusterFuzz, Aug 8 2016 

ClusterFuzz has detected this issue as fixed in range 409589:409828.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6628621276151808

Fuzzer: mbarbella_webgl
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000
Crash State:
  v8::internal::JSObject::AddDataElement
  v8::internal::Object::AddDataProperty
  v8::internal::Object::SetProperty
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=393646:393766
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=409589:409828

Minimized Testcase (0.41 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94qNxcoLsIUMq_gSebS9_yujc9DaNo3tlFdWXZx6nP9NgexT-FoOz6gi2pZ252O2VFHJwQwKGq_nHJdgVImtXpkt1jtKhFmlz47o58c8MTSK53QyMsk9Ri8r3Vn0dX0_hNUsT8VgMJ7TEnsphgfQP3rWmQEhQ?testcase_id=6628621276151808
<script>
      function create_program() {
      }
      function runTests() {
          var canvas = document.createElement('canvas');
          var gl = canvas.getContext('experimental-webgl');
          runTest(gl);
      }
function runTest(gl) {
try { runTest(gl) } catch(e) {; }
try { var buffer = gl.createBuffer() } catch(e) {; }
 gl.bindBuffer(gl.ARRAY_BUFFER, buffer) 
}
</script>
<body onload="runTests()">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 24 by ClusterFuzz, Aug 8 2016 

ClusterFuzz has detected this issue as fixed in range 409589:409828.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6628621276151808

Fuzzer: mbarbella_webgl
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000
Crash State:
  v8::internal::JSObject::AddDataElement
  v8::internal::Object::AddDataProperty
  v8::internal::Object::SetProperty
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=393646:393766
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=409589:409828

Minimized Testcase (0.41 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94qNxcoLsIUMq_gSebS9_yujc9DaNo3tlFdWXZx6nP9NgexT-FoOz6gi2pZ252O2VFHJwQwKGq_nHJdgVImtXpkt1jtKhFmlz47o58c8MTSK53QyMsk9Ri8r3Vn0dX0_hNUsT8VgMJ7TEnsphgfQP3rWmQEhQ?testcase_id=6628621276151808
<script>
      function create_program() {
      }
      function runTests() {
          var canvas = document.createElement('canvas');
          var gl = canvas.getContext('experimental-webgl');
          runTest(gl);
      }
function runTest(gl) {
try { runTest(gl) } catch(e) {; }
try { var buffer = gl.createBuffer() } catch(e) {; }
 gl.bindBuffer(gl.ARRAY_BUFFER, buffer) 
}
</script>
<body onload="runTests()">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 25 by ClusterFuzz, Aug 8 2016 

ClusterFuzz has detected this issue as fixed in range 409589:409828.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6628621276151808

Fuzzer: mbarbella_webgl
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000
Crash State:
  v8::internal::JSObject::AddDataElement
  v8::internal::Object::AddDataProperty
  v8::internal::Object::SetProperty
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=393646:393766
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=409589:409828

Minimized Testcase (0.41 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94qNxcoLsIUMq_gSebS9_yujc9DaNo3tlFdWXZx6nP9NgexT-FoOz6gi2pZ252O2VFHJwQwKGq_nHJdgVImtXpkt1jtKhFmlz47o58c8MTSK53QyMsk9Ri8r3Vn0dX0_hNUsT8VgMJ7TEnsphgfQP3rWmQEhQ?testcase_id=6628621276151808
<script>
      function create_program() {
      }
      function runTests() {
          var canvas = document.createElement('canvas');
          var gl = canvas.getContext('experimental-webgl');
          runTest(gl);
      }
function runTest(gl) {
try { runTest(gl) } catch(e) {; }
try { var buffer = gl.createBuffer() } catch(e) {; }
 gl.bindBuffer(gl.ARRAY_BUFFER, buffer) 
}
</script>
<body onload="runTests()">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 26 by ClusterFuzz, Aug 8 2016 

ClusterFuzz has detected this issue as fixed in range 409589:409828.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6628621276151808

Fuzzer: mbarbella_webgl
Job Type: linux_asan_chrome_v8_arm
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000000
Crash State:
  v8::internal::JSObject::AddDataElement
  v8::internal::Object::AddDataProperty
  v8::internal::Object::SetProperty
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=393646:393766
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_v8_arm&range=409589:409828

Minimized Testcase (0.41 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94qNxcoLsIUMq_gSebS9_yujc9DaNo3tlFdWXZx6nP9NgexT-FoOz6gi2pZ252O2VFHJwQwKGq_nHJdgVImtXpkt1jtKhFmlz47o58c8MTSK53QyMsk9Ri8r3Vn0dX0_hNUsT8VgMJ7TEnsphgfQP3rWmQEhQ?testcase_id=6628621276151808
<script>
      function create_program() {
      }
      function runTests() {
          var canvas = document.createElement('canvas');
          var gl = canvas.getContext('experimental-webgl');
          runTest(gl);
      }
function runTest(gl) {
try { runTest(gl) } catch(e) {; }
try { var buffer = gl.createBuffer() } catch(e) {; }
 gl.bindBuffer(gl.ARRAY_BUFFER, buffer) 
}
</script>
<body onload="runTests()">


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Comment 27 by mummare...@chromium.org, Aug 8 2016

Status: Fixed (was: Available)
As per updates from #10 to #26, marking the bug as fixed.

Thank you.
Project Member

Comment 28 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment