New issue
Advanced search Search tips

Issue 620749 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 620553
Owner:
Closed: Jun 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug-Security



Sign in to add a comment

Crash in v8::internal::FixedArray::set

Project Member Reported by ClusterFuzz, Jun 16 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5036990517215232

Fuzzer: mbarbella_js_mutation
Job Type: windows_asan_d8
Platform Id: windows

Crash Type: UNKNOWN READ
Crash Address: 0x1f400004
Crash State:
  v8::internal::FixedArray::set
  v8::internal::Factory::SetNumberStringCache
  v8::internal::Factory::NumberToString
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_d8&range=400026:400041

Minimized Testcase (10.58 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97QbJ0QZJu0tlCiRbhjdQDmaMs6xfSk3ydJDRT266TsqdDNz_gnSlaFyMDRNoXThx7eUk2RKzjWPqIDXbSa5ta14V_m9QmcxkmcQiSrJzvzKysqLSPFVcx9FAgj8Bv2R6_0_uIlP_jZrUe-9UGv7xUVFhuITg

Filer: inferno

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Owner: jarin@chromium.org
Status: Assigned (was: Available)

Comment 2 by est...@chromium.org, Jun 16 2016

Labels: M-53
Project Member

Comment 3 by ClusterFuzz, Jun 17 2016

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5036990517215232

Fuzzer: mbarbella_js_mutation
Job Type: windows_asan_d8
Platform Id: windows

Crash Type: UNKNOWN READ
Crash Address: 0x1f400004
Crash State:
  v8::internal::FixedArray::set
  v8::internal::Factory::SetNumberStringCache
  v8::internal::Factory::NumberToString
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_d8&range=400026:400041

Minimized Testcase (10.58 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97QbJ0QZJu0tlCiRbhjdQDmaMs6xfSk3ydJDRT266TsqdDNz_gnSlaFyMDRNoXThx7eUk2RKzjWPqIDXbSa5ta14V_m9QmcxkmcQiSrJzvzKysqLSPFVcx9FAgj8Bv2R6_0_uIlP_jZrUe-9UGv7xUVFhuITg

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 4 by sheriffbot@chromium.org, Jun 17 2016

Labels: ReleaseBlock-Beta
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 5 by sheriffbot@chromium.org, Jun 17 2016

Labels: Pri-1
Project Member

Comment 6 by ClusterFuzz, Jun 17 2016

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5036990517215232

Fuzzer: mbarbella_js_mutation
Job Type: windows_asan_d8
Platform Id: windows

Crash Type: UNKNOWN READ
Crash Address: 0x1f400004
Crash State:
  v8::internal::FixedArray::set
  v8::internal::Factory::SetNumberStringCache
  v8::internal::Factory::NumberToString
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_d8&range=400026:400041

Minimized Testcase (10.58 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97QbJ0QZJu0tlCiRbhjdQDmaMs6xfSk3ydJDRT266TsqdDNz_gnSlaFyMDRNoXThx7eUk2RKzjWPqIDXbSa5ta14V_m9QmcxkmcQiSrJzvzKysqLSPFVcx9FAgj8Bv2R6_0_uIlP_jZrUe-9UGv7xUVFhuITg

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Comment 7 by jarin@chromium.org, Jun 22 2016

Mergedinto: 620553
Status: Duplicate (was: Assigned)
Project Member

Comment 8 by sheriffbot@chromium.org, Sep 28 2016

Labels: -Restrict-View-SecurityTeam
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 9 by sheriffbot@chromium.org, Oct 1 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 10 by sheriffbot@chromium.org, Oct 2 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: allpublic

Sign in to add a comment