New issue
Advanced search Search tips

Issue 649268 link

Starred by 2 users
Status: Duplicate
Merged: issue 648373
Owner: ----
Closed: Sep 2016
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug-Security



Sign in to add a comment

Crash in v8::internal::SloppyArgumentsElementsAccessor<v8::internal::SlowSloppyArgumentsE

Project Member Reported by ClusterFuzz, Sep 22 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4588690057986048

Fuzzer: mbarbella_js_mutation
Job Type: windows_asan_d8
Platform Id: windows

Crash Type: UNKNOWN READ
Crash Address: 0x23ccf912
Crash State:
  v8::internal::SloppyArgumentsElementsAccessor<v8::internal::SlowSloppyArgumentsE
  v8::internal::ElementsAccessorBase<v8::internal::SlowSloppyArgumentsElementsAcce
  v8::internal::Runtime_ArrayIncludes_Slow
  
Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_d8&range=419475:419839

Minimized Testcase (0.85 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96kGMiDz2xQuJDYvck-8H0s1jWc7m-cK4UDL__50TeoZmimzm8HqLnMdzTCXCJK9tKQ058CNdvCqYAP5C5_lHgGMIAdElS_Pc2hZYb_yoK_DQ_N2WJJPl8PlYOtIqbWPtqx_KvcRJlTamrCOYMJJ4KMnwT1IA?testcase_id=4588690057986048

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Project Member

Comment 1 by sheriffbot@chromium.org, Sep 22 2016

Labels: M-55
Project Member

Comment 2 by sheriffbot@chromium.org, Sep 22 2016

Labels: ReleaseBlock-Beta
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 3 by sheriffbot@chromium.org, Sep 22 2016

Labels: Pri-1

Comment 4 by elawrence@chromium.org, Sep 22 2016

Cc: vogelheim@chromium.org
Owner: machenb...@chromium.org
Status: Assigned (was: Untriaged)
CC'ing V8 sheriffs.

machenbach@: Can you have a look at this clusterfuzz crash? I looked through the CLs in the range https://chromium.googlesource.com/v8/v8/+log/6bb3bd7f106519d32e9c88a98b79e2463ed0280c..acf3233df89da7f899beb3377e8601ee658f982c?pretty=fuller but was not able to find any obvious suspects.

Thanks!

Comment 5 by machenb...@chromium.org, Sep 23 2016

Cc: -vogelheim@chromium.org
Owner: ----
Status: Untriaged (was: Assigned)
https://github.com/v8/v8/wiki/Triaging-issues

Comment 6 by mstarzinger@chromium.org, Sep 27 2016

Mergedinto: 648373
Status: Duplicate (was: Untriaged)
Project Member

Comment 7 by sheriffbot@chromium.org, Jan 3 2017

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment