Issue metadata
Sign in to add a comment
|
!isolate()->has_pending_exception() in factory.cc |
||||||||||||||||||||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=4537388328288256 Fuzzer: mbarbella_js_mutation Job Type: linux_asan_d8_dbg Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: !isolate()->has_pending_exception() in factory.cc Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_d8_dbg&range=34586:34587 Minimized Testcase (0.33 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv95Q5Uqk1Xbw_mTPUfyPLGfUeaNm9BDTY2pQaeh0XS02sQXsmW8WmbNcmQlrO1FOAmjJheEwTtt0BBm881UG6dbiZHXjd-y2po3B_armU5nWP5ftWUktg9IiFYURvAh4fD7geeFxsuYEUJTNHkR2tyw8Vzx0LA?testcase_id=4537388328288256 __v_1 = function() { }; function __f_3() { return eval("(" + __v_1 + ")"); } function __f_5(asmfunc) { var __v_11 = asmfunc.toString(); var __v_16 = Wasm.instantiateModuleFromAsm(__v_11); } function __f_6() { } function __f_21() { } __v_18 = [, __f_21]; (function () { for (func of __v_18) { __f_5(__f_3(), { }); } })(); Filer: machenbach See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Jun 21 2016
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Apr 25 2017
ClusterFuzz has detected this issue as fixed in range 38805:38806. Detailed report: https://clusterfuzz.com/testcase?key=4537388328288256 Fuzzer: mbarbella_js_mutation Job Type: linux_asan_d8_dbg Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: !isolate()->has_pending_exception() in factory.cc v8::internal::Factory::NewArgumentsObject v8::internal::Handle<v8::internal::JSObject> v8::internal::NewSloppyArguments<v8 Sanitizer: address (ASAN) Regressed: V8: 34586:34587 Fixed: V8: 38805:38806 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4537388328288256 See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Apr 25 2017
ClusterFuzz has detected this issue as fixed in range 38805:38806. Detailed report: https://clusterfuzz.com/testcase?key=4537388328288256 Fuzzer: mbarbella_js_mutation Job Type: linux_asan_d8_dbg Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: !isolate()->has_pending_exception() in factory.cc v8::internal::Factory::NewArgumentsObject v8::internal::Handle<v8::internal::JSObject> v8::internal::NewSloppyArguments<v8 Sanitizer: address (ASAN) Regressed: V8: 34586:34587 Fixed: V8: 38805:38806 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4537388328288256 See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by ishell@chromium.org
, Jun 21 2016Owner: titzer@chromium.org
Status: Assigned (was: Available)