JSObject::GetDataProperty( call_site_obj, isolate->factory()->call_site_position |
||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=4782308983046144 Fuzzer: mbarbella_js_mutation Job Type: linux_msan_d8 Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: JSObject::GetDataProperty( call_site_obj, isolate->factory()->call_site_position Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_d8&range=409094:409122 Minimized Testcase (0.20 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv97vMOsh5ZbCjbJxI3eXC0mGShXV36UY6JQW9rEtS2Y5xy-J3GYWn2SxVonsOTafr2_14USMzaPXkOjIWOQne4DrJZquQADxEP0Loo72WER2jJsv7clpvluY42ZzdP09xTJyBpnMMmXykihOV70NtcTQaCmp8w?testcase_id=4782308983046144 var __v_2 = {}; Error.prepareStackTrace = (e,s) => s; __v_1 = Error().stack[0].constructor; function __f_1() {} __v_3 = __v_1.call(null, __v_2, __f_1, {valueOf() { return 0 }}); __v_3.getLineNumber(); Filer: nyerramilli See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Aug 2 2016
Jakob is this related to https://chromium.googlesource.com/v8/v8/+/061d082dd3cb038b7f14b0de1e92aa6b4e083a43 ?
,
Aug 2 2016
It's part of the expected clusterfuzz failures around the exposed CallSite constructor. This should be fixed by 8135caef32492b900f9d1d25276038d224b72ae1.
,
Aug 2 2016
,
Aug 3 2016
ClusterFuzz has detected this issue as fixed in range 409122:409134. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4782308983046144 Fuzzer: mbarbella_js_mutation Job Type: linux_msan_d8 Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: JSObject::GetDataProperty( call_site_obj, isolate->factory()->call_site_position Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_d8&range=409094:409122 Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_d8&range=409122:409134 Minimized Testcase (0.20 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv97vMOsh5ZbCjbJxI3eXC0mGShXV36UY6JQW9rEtS2Y5xy-J3GYWn2SxVonsOTafr2_14USMzaPXkOjIWOQne4DrJZquQADxEP0Loo72WER2jJsv7clpvluY42ZzdP09xTJyBpnMMmXykihOV70NtcTQaCmp8w?testcase_id=4782308983046144 var __v_2 = {}; Error.prepareStackTrace = (e,s) => s; __v_1 = Error().stack[0].constructor; function __f_1() {} __v_3 = __v_1.call(null, __v_2, __f_1, {valueOf() { return 0 }}); __v_3.getLineNumber(); See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Oct 18 2016
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by nyerramilli@google.com
, Aug 2 2016Components: Tools>Test>FindIt>NoResult
Labels: Needs-triage findit-wrong Te-Logged