Issue metadata
Sign in to add a comment
|
Crash in v8::internal::JSObject::UpdateAllocationSite |
||||||||||||||||||||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5657306247462912 Fuzzer: mbarbella_js_mutation Job Type: windows_asan_d8 Platform Id: windows Crash Type: UNKNOWN READ Crash Address: 0x2570b724 Crash State: v8::internal::JSObject::UpdateAllocationSite v8::internal::JSObject::TransitionElementsKind v8::internal::LookupIterator::PrepareForDataProperty Recommended Security Severity: Low Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_d8&range=403853:403869 Minimized Testcase (17.80 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95Jo4cSyGMj7pKpe6lT8li8EilJDv-U9HVMSEQOwDvCc1GsC7yyROGnUhXe4bKH7Tcmuru2nTpFDwQvaesMvioOEGOvO5ZzcjEI-0kMbNE6y9E3302i3bxPrdpn_nwk-WBs3KNH1fpGN2AGEl6fPZ_HNzUwNxMjdLEnv7ARimQmYGv2HG4?testcase_id=5657306247462912 Additional requirements: Requires Gestures Filer: mmoroz See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Jul 12 2016
,
Jul 12 2016
,
Jul 12 2016
,
Jul 26 2016
Hi Michael,
This issue bisects cleanly to your CL:
Reland "[heap] Add page evacuation mode for new->new"
Adds an evacuation mode that allows moving pages within new space without
copying objects.
https://codereview.chromium.org/2078863002
It looks like there must be a way to add an allocation memento that points to a dead AllocationSite. I remember we had an issue once that we didn't scan new space until sweeping old space...and during that sweep we might have discarded allocation sites. I believe this is why we introduced the "zombie" state to the AllocationSite.
Could it be a similar problem going on for this new work?
,
Jul 27 2016
,
Nov 4 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by mmoroz@chromium.org
, Jul 12 2016