New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 633585 link

Starred by 2 users
Status: Fixed
Owner:
mstarzinger@chromium.org
Closed: Aug 2016
Cc:
jochen@chromium.org
bmeu...@chromium.org
jarin@chromium.org
█ rossberg@chromium.org
ishell@chromium.org
mstarzinger@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security



Sign in to add a comment

Crash in v8::internal::InnerPointerToCodeCache::GcSafeFindCodeForInnerPointer

Project Member Reported by ClusterFuzz, Aug 2 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5839163693989888

Fuzzer: mbarbella_js_mutation
Job Type: linux_v8_d8_tot
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x7ffca1800030
Crash State:
  v8::internal::InnerPointerToCodeCache::GcSafeFindCodeForInnerPointer
  v8::internal::InnerPointerToCodeCache::GetCacheEntry
  v8::internal::StackFrame::ComputeType
  
Regressed: V8: r34567:34577

Minimized Testcase (0.27 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96eAfSXUcUuqHcmiK_Hn-8MicqLB0o_WeH1uWx5zG0wQlEQpkylfryHFyowA41lWTpaJQLSf7XDyY9oZO4I51dUstiv5abr9qA7g5TYG0o8oLFcpl-Ff8iYDtNmXMm1tMNVQH51Ar77_YAA1SyFqM6OttJIUw?testcase_id=5839163693989888
function __f_0() { this.x = this.x.x; }
gc();
__f_0.prototype.x = {x: 1}
new __f_0();
new __f_0();
function __f_9(ensure_fast_case) {
  function __f_12() {
  };
  __f_12.prototype = { set x(value) { this.y = 23; } };

    new __f_0();
}

__f_9();
__v_15.__defineGetter__();


Filer: inferno

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by aarya@google.com, Aug 2 2016 

 Issue 633586  has been merged into this issue.

Comment 2 by raymes@chromium.org, Aug 2 2016

Cc: jochen@chromium.org
Components: Blink>JavaScript
Labels: Pri-1
Owner: mbarbe...@chromium.org
Status: Assigned (was: Untriaged)
mbarbella/jochen: not sure who to ping for this. Could you help me find an owner? Thanks!

Comment 3 by raymes@chromium.org, Aug 2 2016

Labels: Security_Impact-Stable

Comment 4 by mbarbella@google.com, Aug 3 2016

Cc: ishell@chromium.org mstarzinger@chromium.org
Owner: ----
Status: Available (was: Assigned)
Ccing v8 clusterfuzz sheriffs.

Comment 5 by mstarzinger@chromium.org, Aug 3 2016

Cc: rossberg@chromium.org
Project Member

Comment 6 by sheriffbot@chromium.org, Aug 3 2016

Labels: M-53

Comment 7 by raymes@chromium.org, Aug 4 2016

Owner: rossberg@chromium.org
Assigning to rossberg for now based on #5. Please help find a better owner if there is one.

Comment 8 by mstarzinger@chromium.org, Aug 4 2016 

Missing bailout point for TurboFan. I am working on a fix.

Comment 9 by mstarzinger@chromium.org, Aug 4 2016

Owner: mstarzinger@chromium.org
Status: Assigned (was: Available)

Comment 10 by mstarzinger@chromium.org, Aug 4 2016 

Yeah, Runtime::kDefineAccessorPropertyUnchecked should not lazy deopt on a new literal, famous last words ...

(gdb) bt
#0  v8::internal::DependentCode::SetMarkedForDeoptimization (code=0x1d5b32c74001, group=v8::internal::DependentCode::kPrototypeCheckGroup) at ../src/objects.cc:14912
#1  0x000000000147853e in v8::internal::DependentCode::MarkCodeForDeoptimization (this=0x192d33a05911, isolate=0x2347020, group=v8::internal::DependentCode::kPrototypeCheckGroup) at ../src/objects.cc:14878
#2  0x000000000143c8db in v8::internal::DependentCode::DeoptimizeDependentCodeGroup (this=0x192d33a05911, isolate=0x2347020, group=v8::internal::DependentCode::kPrototypeCheckGroup) at ../src/objects.cc:14905
#3  0x000000000143c966 in v8::internal::Map::NotifyLeafMapLayoutChange (this=0x137d25e0bf21) at .././src/objects-inl.h:4822
#4  0x000000000144c26f in v8::internal::Map::Normalize (fast_map=..., mode=v8::internal::CLEAR_INOBJECT_PROPERTIES, reason=0x1e3f6d9 "AccessorsOverwritingNonAccessors") at ../src/objects.cc:8776
#5  0x0000000001461006 in v8::internal::Map::TransitionToAccessorProperty (isolate=0x2347020, map=..., name=..., descriptor=0, getter=..., setter=..., attributes=v8::internal::NONE) at ../src/objects.cc:9480
#6  0x00000000013f04f8 in v8::internal::LookupIterator::TransitionToAccessorProperty (this=0x7fffffffc970, getter=..., setter=..., attributes=v8::internal::NONE) at ../src/lookup.cc:458
#7  0x0000000001453615 in v8::internal::JSObject::DefineAccessor (it=0x7fffffffc970, getter=..., setter=..., attributes=v8::internal::NONE) at ../src/objects.cc:8604
#8  0x000000000145db58 in v8::internal::JSObject::DefineAccessor (object=..., name=..., getter=..., setter=..., attributes=v8::internal::NONE) at ../src/objects.cc:8573
#9  0x00000000015ceea3 in v8::internal::__RT_impl_Runtime_DefineAccessorPropertyUnchecked (args=..., isolate=0x2347020) at ../src/runtime/runtime-object.cc:691
#10 0x00000000015ce896 in v8::internal::Runtime_DefineAccessorPropertyUnchecked (args_length=5, args_object=0x7fffffffcb68, isolate=0x2347020) at ../src/runtime/runtime-object.cc:679

Comment 11 by mstarzinger@chromium.org, Aug 4 2016

Cc: jarin@chromium.org bmeu...@chromium.org
Project Member

Comment 12 by bugdroid1@chromium.org, Aug 4 2016 

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/667d8ad099f05a1e90c7a43b70af8964ac6ca7a6

commit 667d8ad099f05a1e90c7a43b70af8964ac6ca7a6
Author: mstarzinger <mstarzinger@chromium.org>
Date: Thu Aug 04 10:25:03 2016

[turbofan] Fix missing bailout for accessors in literals.

This adds the missing lazy bailout point when defining accessor pairs
within object literals via Runtime::kDefineAccessorPropertyUnchecked.
The runtime function in question can indeed trigger a lazy deopt due
to a DependentCode::kPrototypeCheckGroup dependency.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-633585
BUG= chromium:633585 

Review-Url: https://codereview.chromium.org/2207413002
Cr-Commit-Position: refs/heads/master@{#38336}

[modify] https://crrev.com/667d8ad099f05a1e90c7a43b70af8964ac6ca7a6/src/ast/ast.h
[modify] https://crrev.com/667d8ad099f05a1e90c7a43b70af8964ac6ca7a6/src/compiler/ast-graph-builder.cc
[modify] https://crrev.com/667d8ad099f05a1e90c7a43b70af8964ac6ca7a6/src/full-codegen/arm/full-codegen-arm.cc
[modify] https://crrev.com/667d8ad099f05a1e90c7a43b70af8964ac6ca7a6/src/full-codegen/arm64/full-codegen-arm64.cc
[modify] https://crrev.com/667d8ad099f05a1e90c7a43b70af8964ac6ca7a6/src/full-codegen/ia32/full-codegen-ia32.cc
[modify] https://crrev.com/667d8ad099f05a1e90c7a43b70af8964ac6ca7a6/src/full-codegen/mips/full-codegen-mips.cc
[modify] https://crrev.com/667d8ad099f05a1e90c7a43b70af8964ac6ca7a6/src/full-codegen/mips64/full-codegen-mips64.cc
[modify] https://crrev.com/667d8ad099f05a1e90c7a43b70af8964ac6ca7a6/src/full-codegen/ppc/full-codegen-ppc.cc
[modify] https://crrev.com/667d8ad099f05a1e90c7a43b70af8964ac6ca7a6/src/full-codegen/s390/full-codegen-s390.cc
[modify] https://crrev.com/667d8ad099f05a1e90c7a43b70af8964ac6ca7a6/src/full-codegen/x64/full-codegen-x64.cc
[modify] https://crrev.com/667d8ad099f05a1e90c7a43b70af8964ac6ca7a6/src/full-codegen/x87/full-codegen-x87.cc
[add] https://crrev.com/667d8ad099f05a1e90c7a43b70af8964ac6ca7a6/test/mjsunit/regress/regress-crbug-633585.js

Comment 13 by mstarzinger@chromium.org, Aug 4 2016

Status: Fixed (was: Assigned)
Project Member

Comment 14 by sheriffbot@chromium.org, Aug 4 2016

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify

Comment 15 by awhalley@chromium.org, Aug 10 2016

Labels: Merge-Request-53

Comment 16 by dimu@chromium.org, Aug 10 2016

Labels: -Merge-Request-53 Merge-Approved-53 Hotlist-Merge-Approved
Your change meets the bar and is auto-approved for M53 (branch: 2785)

Comment 17 by gov...@chromium.org, Aug 11 2016 

Please merge your change to M53 branch 2785 ASAP (latest before 5:00 PM PT, Friday 08/12) so we can take it in for next week beta. Thank you.

Comment 18 by mstarzinger@chromium.org, Aug 11 2016 

Has been merged to V8's 5.3 branch. For some reason Bugdroid didn't post a notification.

https://chromium.googlesource.com/v8/v8/+/c7f317240d90d95bf34e754e3199fbbb588ecd4c

Comment 19 by hablich@chromium.org, Aug 11 2016

Labels: -Merge-Approved-53 Merge-Merged-53
Project Member

Comment 20 by bugdroid1@chromium.org, Aug 11 2016

Labels: merge-merged-5.3
The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/c7f317240d90d95bf34e754e3199fbbb588ecd4c

commit c7f317240d90d95bf34e754e3199fbbb588ecd4c
Author: Michael Starzinger <mstarzinger@google.com>
Date: Thu Aug 11 08:51:26 2016

Merged: [turbofan] Fix missing bailout for accessors in literals.

Revision: 667d8ad099f05a1e90c7a43b70af8964ac6ca7a6

BUG= chromium:633585 
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=bmeurer@chromium.org
CC=hablich@chromium.org

Review URL: https://codereview.chromium.org/2230983005 .

Cr-Commit-Position: refs/branch-heads/5.3@{#40}
Cr-Branched-From: 820a23aade5e74a92d794e05a0c2b3597f0da4b5-refs/heads/5.3.332@{#2}
Cr-Branched-From: 37538cb2c1b4d75c41af386cb4fedbe5566f5608-refs/heads/master@{#37308}

[modify] https://crrev.com/c7f317240d90d95bf34e754e3199fbbb588ecd4c/src/ast/ast.h
[modify] https://crrev.com/c7f317240d90d95bf34e754e3199fbbb588ecd4c/src/compiler/ast-graph-builder.cc
[modify] https://crrev.com/c7f317240d90d95bf34e754e3199fbbb588ecd4c/src/full-codegen/arm/full-codegen-arm.cc
[modify] https://crrev.com/c7f317240d90d95bf34e754e3199fbbb588ecd4c/src/full-codegen/arm64/full-codegen-arm64.cc
[modify] https://crrev.com/c7f317240d90d95bf34e754e3199fbbb588ecd4c/src/full-codegen/ia32/full-codegen-ia32.cc
[modify] https://crrev.com/c7f317240d90d95bf34e754e3199fbbb588ecd4c/src/full-codegen/mips/full-codegen-mips.cc
[modify] https://crrev.com/c7f317240d90d95bf34e754e3199fbbb588ecd4c/src/full-codegen/mips64/full-codegen-mips64.cc
[modify] https://crrev.com/c7f317240d90d95bf34e754e3199fbbb588ecd4c/src/full-codegen/ppc/full-codegen-ppc.cc
[modify] https://crrev.com/c7f317240d90d95bf34e754e3199fbbb588ecd4c/src/full-codegen/s390/full-codegen-s390.cc
[modify] https://crrev.com/c7f317240d90d95bf34e754e3199fbbb588ecd4c/src/full-codegen/x64/full-codegen-x64.cc
[modify] https://crrev.com/c7f317240d90d95bf34e754e3199fbbb588ecd4c/src/full-codegen/x87/full-codegen-x87.cc
[add] https://crrev.com/c7f317240d90d95bf34e754e3199fbbb588ecd4c/test/mjsunit/regress/regress-crbug-633585.js

Comment 21 by awhalley@chromium.org, Aug 26 2016

Labels: Release-0-M53

Comment 22 by awhalley@chromium.org, Sep 14 2016

Labels: CVE-2016-5167
Project Member

Comment 23 by sheriffbot@chromium.org, Nov 10 2016

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 24 by awhalley@chromium.org, Apr 25 2018

Labels: CVE_description-submitted
►

Sign in to add a comment