New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 640279 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Last visit > 30 days ago
Closed: Dec 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug



Sign in to add a comment

Crash in v8::internal::LookupIterator::LookupIterator

Project Member Reported by ClusterFuzz, Aug 23 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5310813793681408

Fuzzer: mbarbella_js_mutation
Job Type: windows_asan_d8
Platform Id: windows

Crash Type: UNKNOWN READ
Crash Address: 0x00000000
Crash State:
  v8::internal::LookupIterator::LookupIterator
  v8::internal::StdlibMathMember
  v8::internal::AsmJs::IsStdlibValid
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_d8&range=413625:413636

Minimized Testcase (0.26 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96SHicQ9esFBWX3gFHsq509jFfL_RZQ85UYeczFtilImke21BOp_gzYWpF8rJscgo0v20LstsSqlVecHhoHOXGOrYYE2A28iIlNnzXEebnIiuavMyoc1Jw21UHiqs3lkVU8ZptidLghLCepbrAj9IOvdEXvnw?testcase_id=5310813793681408
function __f_74(expected, __f_91, __f_22) {
 Wasm.instantiateModuleFromAsm( __f_91.toString());
}
(function () {
})();
function __f_100(__v_22) {
  "use asm";
  var __v_27 = __v_22.Math.fround;
  function __f_91() {
  }
  return {__f_34: __f_91};
}
__f_74(1, __f_100);


Issue manually filed by: mmohammad

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: bradnelson@chromium.org yangguo@chromium.org
Owner: verwa...@chromium.org
Status: Assigned (was: Untriaged)
This might be a suspected cl:
https://chromium.googlesource.com/v8/v8/+/93e744a77766f8643d1216852ebf3a94713a4c5b%5E%21/src/lookup.h

verwaest@ could you please look into this. Thanks
Cc: -bradnelson@chromium.org verwa...@chromium.org
Owner: bradnelson@chromium.org
Project Member

Comment 3 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 4 by ClusterFuzz, Dec 2 2016

Status: WontFix (was: Assigned)
ClusterFuzz testcase is no longer reproducible, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment