New issue
Advanced search Search tips

Issue 651254 link

Starred by 1 user
Status: Fixed
Owner:
cbruni@chromium.org
Closed: Sep 2016
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug



Sign in to add a comment

feedback == *TypeFeedbackVector::UninitializedSentinel(isolate) in type-feedback

Project Member Reported by ClusterFuzz, Sep 28 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6682925741637632

Fuzzer: mbarbella_js_mutation
Job Type: windows_asan_d8
Platform Id: windows

Crash Type: CHECK failure
Crash Address: 
Crash State:
  feedback == *TypeFeedbackVector::UninitializedSentinel(isolate) in type-feedback
  V8_Fatal
  v8::internal::CallICNexus::StateFromFeedback
  v8::internal::Runtime_CallIC_Miss
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_d8&range=421045:421431

Minimized Testcase (2.78 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94z_aS8_8vQXAHWpmCN7IZZ2K58imqYilGKI0wcv9thmEfuSVBAmblGpBXqPHDeuE-tFZpTonWYK43UAu-wiayFV5Cxud4IPHxzYtVeBeeRIzO1gt0alhOgzNx6xrAtZV-KGuB-0tl5aP7tuLzZtYpSmBccSg?testcase_id=6682925741637632

Issue manually filed by: mummareddy

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by mummare...@chromium.org, Sep 28 2016

Components: Tools>Test>FindIt>NoResult
Labels: M-55 Te-Logged
Owner: mvstan...@chromium.org
Status: Assigned (was: Untriaged)
Through code search on file type-feedback-vector.cc, suspected CL is 
https://chromium.googlesource.com/v8/v8/+/b88d132f4cbc4a7f4de106542ae5895079049070
mvstanton@, could you please take a look and help us to find correct owner if it is not related your changes.

Comment 2 by mvstan...@chromium.org, Sep 29 2016

Status: Started (was: Assigned)

Comment 3 by mvstan...@chromium.org, Sep 29 2016

Status: Assigned (was: Started)
Bisects to: https://codereview.chromium.org/2377593002
(Reland of Preparse functions in the scope that was created when parsing of the function was started)

I think maybe the function is parsed once with sloppy mode and once with strict mode, and something like that could influence the # of feedback vector slots.
That would cause this kind of bug.

Camillo, does it make sense that something like that can happen?

Comment 4 by mvstan...@chromium.org, Sep 29 2016

Owner: cbruni@chromium.org

Comment 5 by mvstan...@chromium.org, Sep 29 2016

Status: Fixed (was: Assigned)
Nice. Fixed by Toon in tip of tree. https://codereview.chromium.org/2380993003

Comment 6 by kateso...@chromium.org, Oct 18 2016

Components: -Tools>Test>FindIt>NoResult
Project Member

Comment 7 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment