New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 621117 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 620750
Owner:
Closed: Jun 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 1
Type: Bug-Security



Sign in to add a comment

Crash in v8::internal::NewSpace::Size

Project Member Reported by ClusterFuzz, Jun 17 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6618045556719616

Fuzzer: mbarbella_js_mutation
Job Type: windows_asan_d8
Platform Id: windows

Crash Type: UNKNOWN READ
Crash Address: 0x23900008
Crash State:
  v8::internal::NewSpace::Size
  v8::internal::Heap::MarkCompact
  v8::internal::Heap::PerformGarbageCollection
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_d8&range=400115:400122

Minimized Testcase (10.70 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95vExFTHI718HzX0WtRBKNoni2H3eMPCF2drEI-x8ozgjiryLd-nyujx-sZESnnWvrnM6K1JQJ9CpPHglpG9PEt7bt-fZDTimBSTTTMN0v-l9M5IeNmJt_x7CpXMO-hS1X5fc4qKb3GKXYDW4wg35-i5yxE3A

Filer: mmoroz

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 

Comment 1 by mmoroz@chromium.org, Jun 17 2016

Components: -Blink>JavaScript Blink>JavaScript>GC

Comment 2 by est...@chromium.org, Jun 17 2016

Labels: M-53
Owner: mstarzinger@chromium.org
mstarzinger, could you please help find the right owner for this? Thanks!
Project Member

Comment 3 by ClusterFuzz, Jun 17 2016

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6618045556719616

Fuzzer: mbarbella_js_mutation
Job Type: windows_asan_d8
Platform Id: windows

Crash Type: UNKNOWN READ
Crash Address: 0x23900008
Crash State:
  v8::internal::NewSpace::Size
  v8::internal::Heap::MarkCompact
  v8::internal::Heap::PerformGarbageCollection
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_d8&range=400115:400122

Minimized Testcase (10.70 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95vExFTHI718HzX0WtRBKNoni2H3eMPCF2drEI-x8ozgjiryLd-nyujx-sZESnnWvrnM6K1JQJ9CpPHglpG9PEt7bt-fZDTimBSTTTMN0v-l9M5IeNmJt_x7CpXMO-hS1X5fc4qKb3GKXYDW4wg35-i5yxE3A?testcase_id=6618045556719616

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 4 by ClusterFuzz, Jun 18 2016

Status: Assigned (was: Available)
Project Member

Comment 5 by sheriffbot@chromium.org, Jun 18 2016

Labels: ReleaseBlock-Beta
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 6 by sheriffbot@chromium.org, Jun 18 2016

Labels: Pri-1

Comment 7 by ishell@chromium.org, Jun 22 2016

Owner: ishell@chromium.org

Comment 8 by ishell@chromium.org, Jun 22 2016

Cc: mlippautz@chromium.org
Cc: -mlippautz@chromium.org
Labels: -OS-Windows OS-All
Owner: mlippautz@chromium.org
Mergedinto: 620750
Status: Duplicate (was: Assigned)
Last tested stack trace matches  issue 620750 . A fix is already on the way.
Project Member

Comment 11 by ClusterFuzz, Jun 23 2016

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6618045556719616

Fuzzer: mbarbella_js_mutation
Job Type: windows_asan_d8
Platform Id: windows

Crash Type: UNKNOWN READ
Crash Address: 0x23900008
Crash State:
  v8::internal::NewSpace::Size
  v8::internal::Heap::MarkCompact
  v8::internal::Heap::PerformGarbageCollection
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_d8&range=400115:400122

Minimized Testcase (10.70 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95vExFTHI718HzX0WtRBKNoni2H3eMPCF2drEI-x8ozgjiryLd-nyujx-sZESnnWvrnM6K1JQJ9CpPHglpG9PEt7bt-fZDTimBSTTTMN0v-l9M5IeNmJt_x7CpXMO-hS1X5fc4qKb3GKXYDW4wg35-i5yxE3A?testcase_id=6618045556719616

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 12 by sheriffbot@chromium.org, Sep 29 2016

Labels: -Restrict-View-SecurityTeam
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 13 by sheriffbot@chromium.org, Oct 1 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 14 by sheriffbot@chromium.org, Oct 2 2016

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: allpublic

Sign in to add a comment