New issue
Advanced search Search tips

Issue 647217 link

Starred by 1 user
Status: Fixed
Owner:
mstarzinger@chromium.org
Closed: Sep 2016
Cc:
rmcilroy@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

!info_->isolate()->has_pending_exception() in js-inlining.cc

Project Member Reported by ClusterFuzz, Sep 15 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4591218694815744

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !info_->isolate()->has_pending_exception() in js-inlining.cc
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97kCd7cxC-08SZP_Dfs2Edpyg7-FcES5Bo2Pl74yeTov5VlL2ACCKE1J7TwZ_YQsWZ1C54Bd1ouemLOWM5taw04D7edsYPIKMkMlWk9f-pyj8IYNggyFwX1U0QkN3JA0ThDW0iTxY0Tr6ZqYVhkCkdq-y2WJw?testcase_id=4591218694815744


Issue manually filed by: mstarzinger

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by mstarzinger@chromium.org, Sep 15 2016

Cc: -mstarzinger@chromium.org rmcilroy@chromium.org
Owner: mstarzinger@chromium.org
Status: Assigned (was: Untriaged)
This is mine.
Project Member

Comment 2 by bugdroid1@chromium.org, Sep 15 2016 

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/c2cf8b11edfef9fce73939c3137de2e65f1a75a6

commit c2cf8b11edfef9fce73939c3137de2e65f1a75a6
Author: mstarzinger <mstarzinger@chromium.org>
Date: Thu Sep 15 14:04:31 2016

[turbofan] Handle stack overflow during inlining.

This handles the case where generating bytecode for inlining purposes
causes a stack overflow. We just abort inlining but also need to clear
pending exceptions.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-647217
BUG= chromium:647217 

Review-Url: https://codereview.chromium.org/2339383002
Cr-Commit-Position: refs/heads/master@{#39448}

[modify] https://crrev.com/c2cf8b11edfef9fce73939c3137de2e65f1a75a6/src/compiler/js-inlining.cc
[add] https://crrev.com/c2cf8b11edfef9fce73939c3137de2e65f1a75a6/test/mjsunit/regress/regress-crbug-647217.js

Comment 3 by mstarzinger@chromium.org, Sep 15 2016

Status: Fixed (was: Assigned)
Project Member

Comment 4 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment