New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 664802 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Nov 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

!v8::internal::FLAG_enable_slow_asserts || (object->IsJSObject()) in objects-inl

Project Member Reported by ClusterFuzz, Nov 13 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6617766762381312

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !v8::internal::FLAG_enable_slow_asserts || (object->IsJSObject()) in objects-inl
  
Regressed: V8: r40945:40946

Minimized Testcase (0.46 Kb): https://cluster-fuzz.appspot.com/download/AMIfv945siS71pC8PbvolAPG4iF1SAGqbaULpMBN53lagvNSUTHCP5259hvWyjzy95JLckjDB4JSAGiF8D-AJPNT1kA_GTB_XDMbXum3B-svcIJK6HyP4PzoovMRYYNBGLkh8P_ROcmvHpka59KvJ8FxIVowO94Zig?testcase_id=6617766762381312

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: msrchandra@chromium.org
Labels: Test-Predator-Wrong
Owner: ishell@chromium.org
Status: Assigned (was: Untriaged)
Find it does not provide any possible suspects, below is the find it results
Suspected CLs	Findit failed to find any stack trace. Is it in a new format?

From the regressed CL assigning to the concern owner,
https://chromium.googlesource.com/v8/v8/+log/5d3ce7ea4fa299f8463ee15282fa986b50702cd8..bcb3af59be2c52ca13a0adae500f042a64093b6d?pretty=fuller

Suspecting Commit# bcb3af59be2c52ca13a0adae500f042a64093b6d
Suspecting Review URL# https://codereview.chromium.org/2488673004

@ishell -- Could you please look into the issue, kindly re-assign if not related to your changes.
Thank You.

Comment 2 by ishell@chromium.org, Nov 18 2016

Status: Started (was: Assigned)

Comment 4 by ishell@chromium.org, Nov 21 2016

Status: Fixed (was: Started)
Project Member

Comment 5 by ClusterFuzz, Nov 22 2016

ClusterFuzz has detected this issue as fixed in range 41132:41133.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6617766762381312

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !v8::internal::FLAG_enable_slow_asserts || (object->IsJSObject()) in objects-inl
  
Regressed: V8: r40945:40946
Fixed: V8: r41132:41133

Minimized Testcase (0.46 Kb): https://cluster-fuzz.appspot.com/download/AMIfv945siS71pC8PbvolAPG4iF1SAGqbaULpMBN53lagvNSUTHCP5259hvWyjzy95JLckjDB4JSAGiF8D-AJPNT1kA_GTB_XDMbXum3B-svcIJK6HyP4PzoovMRYYNBGLkh8P_ROcmvHpka59KvJ8FxIVowO94Zig?testcase_id=6617766762381312

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 7 by bugdroid1@chromium.org, Dec 5 2016

Labels: merge-merged-5.6
The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/8feaaa256e6e36aad210467d808001bc26471e98

commit 8feaaa256e6e36aad210467d808001bc26471e98
Author: ishell@chromium.org <ishell@chromium.org>
Date: Mon Dec 05 12:47:56 2016

Merged: Squashed multiple commits.

Merged: [ic] Invalidate prototype validity cell when a slow prototype becomes fast.
Revision: f718cd1309be2327d1d218560f8663f8b165e4fa

Merged: [ic] Don't check full prototype chain if name is a private symbol.
Revision: 4513532f6362353eaf50ec30d753a346e795b164

BUG= chromium:664802 , chromium:664974 , chromium:665886 ,v8:5561
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/2554503002 .

Cr-Commit-Position: refs/branch-heads/5.6@{#32}
Cr-Branched-From: bdd3886218dfe76e8560eb8a18401942452ae859-refs/heads/5.6.326@{#1}
Cr-Branched-From: 879f6599eee6e1dfcbe9a24bf688b261c03e9558-refs/heads/master@{#41014}

[modify] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/src/factory.cc
[modify] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/src/ic/ic.cc
[modify] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/src/objects.cc
[modify] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/src/objects.h
[modify] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/src/prototype.h
[add] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/test/mjsunit/regress/regress-crbug-664802.js
[add] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/test/mjsunit/regress/regress-crbug-664974.js
[add] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/test/mjsunit/regress/regress-crbug-665886.js

Sign in to add a comment