New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 633525 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Aug 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

JSObject::GetDataProperty( call_site_obj, isolate->factory()->call_site_position

Project Member Reported by ClusterFuzz, Aug 2 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4782308983046144

Fuzzer: mbarbella_js_mutation
Job Type: linux_msan_d8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  JSObject::GetDataProperty( call_site_obj, isolate->factory()->call_site_position
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_d8&range=409094:409122

Minimized Testcase (0.20 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97vMOsh5ZbCjbJxI3eXC0mGShXV36UY6JQW9rEtS2Y5xy-J3GYWn2SxVonsOTafr2_14USMzaPXkOjIWOQne4DrJZquQADxEP0Loo72WER2jJsv7clpvluY42ZzdP09xTJyBpnMMmXykihOV70NtcTQaCmp8w?testcase_id=4782308983046144
var __v_2 = {};
Error.prepareStackTrace = (e,s) => s;
__v_1 = Error().stack[0].constructor;
function __f_1() {}
__v_3 = __v_1.call(null, __v_2, __f_1, {valueOf() { return 0 }});
 __v_3.getLineNumber();


Filer: nyerramilli

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: nyerramilli@chromium.org
Components: Tools>Test>FindIt>NoResult
Labels: Needs-triage findit-wrong Te-Logged
providing Findit results for internal purpose:
Suspected CLs	Stack does not contain enough information for Findit to run.

Unable to find the culprit, requesting Dev team to look into the issue.
Cc: rossberg@chromium.org jgruber@chromium.org
Status: Available (was: Untriaged)
Jakob is this related to https://chromium.googlesource.com/v8/v8/+/061d082dd3cb038b7f14b0de1e92aa6b4e083a43 ?
Cc: -jgruber@chromium.org
Labels: -Needs-triage
Owner: jgruber@chromium.org
Status: Assigned (was: Available)
It's part of the expected clusterfuzz failures around the exposed CallSite constructor. This should be fixed by 8135caef32492b900f9d1d25276038d224b72ae1.
Status: Fixed (was: Assigned)
Project Member

Comment 5 by ClusterFuzz, Aug 3 2016

ClusterFuzz has detected this issue as fixed in range 409122:409134.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4782308983046144

Fuzzer: mbarbella_js_mutation
Job Type: linux_msan_d8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  JSObject::GetDataProperty( call_site_obj, isolate->factory()->call_site_position
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_d8&range=409094:409122
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_msan_d8&range=409122:409134

Minimized Testcase (0.20 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97vMOsh5ZbCjbJxI3eXC0mGShXV36UY6JQW9rEtS2Y5xy-J3GYWn2SxVonsOTafr2_14USMzaPXkOjIWOQne4DrJZquQADxEP0Loo72WER2jJsv7clpvluY42ZzdP09xTJyBpnMMmXykihOV70NtcTQaCmp8w?testcase_id=4782308983046144
var __v_2 = {};
Error.prepareStackTrace = (e,s) => s;
__v_1 = Error().stack[0].constructor;
function __f_1() {}
__v_3 = __v_1.call(null, __v_2, __f_1, {valueOf() { return 0 }});
 __v_3.getLineNumber();


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Components: -Tools>Test>FindIt>NoResult
Project Member

Comment 7 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment