InputCountField::is_valid(input_count) in instruction.h |
||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5996304442589184 Fuzzer: mbarbella_js_mutation Job Type: linux_v8_d8_be Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: InputCountField::is_valid(input_count) in instruction.h Minimized Testcase (0.14 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv96Np8xO8ld1q2Hfx6YnAc6H1uusIrN04WMNxAaGah_K-9KoRMP-7hY79Qaq5gSE2P39wDH-KUDhQPF9kFjHCCUKK6zkOoou-ksujv_lmPiHunNxdMR_1PFCWeJ9vcM8H_pmU8ZIsy2QtbH5OO8X30cFKpBfIA?testcase_id=5996304442589184 "use strict"; var __v_1 = {}; __v_1 = ""; for (var __v_0 = 0; __v_0 < 65535; __v_0++) { __v_1 += ("var a" + __v_0 + ";"); } eval(__v_1); Filer: mstarzinger See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Jul 25 2016
,
Oct 5 2016
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/a974970cffae3380c2b96cc5fc6210bd5826871c commit a974970cffae3380c2b96cc5fc6210bd5826871c Author: jarin <jarin@chromium.org> Date: Wed Oct 05 05:43:21 2016 [turbofan] Check instruction input/output count limits in instruction selector. BUG= chromium:625966 Review-Url: https://codereview.chromium.org/2390303002 Cr-Commit-Position: refs/heads/master@{#39970} [modify] https://crrev.com/a974970cffae3380c2b96cc5fc6210bd5826871c/src/compiler/instruction-selector.cc [modify] https://crrev.com/a974970cffae3380c2b96cc5fc6210bd5826871c/src/compiler/instruction-selector.h [modify] https://crrev.com/a974970cffae3380c2b96cc5fc6210bd5826871c/src/compiler/instruction.h [modify] https://crrev.com/a974970cffae3380c2b96cc5fc6210bd5826871c/src/compiler/pipeline.cc [add] https://crrev.com/a974970cffae3380c2b96cc5fc6210bd5826871c/test/mjsunit/compiler/regress-625966.js
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Dec 22 2016
ClusterFuzz testcase 5996304442589184 is flaky and no longer reproduces, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by mstarzinger@chromium.org
, Jul 6 2016Components: Blink>JavaScript>Compiler