This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Hi Michael,

Assigning this security bug to you, due to your CL that touches heap tracing: https://chromium.googlesource.com/v8/v8/+/17318bbd393f8e1b60a00d1cb1fb57befdec0874

CC'ing sigbjornf@opera as well who also touched these areas: https://chromium.googlesource.com/chromium/src/+/2c7d13f7694fa208d996947731eacd152902ebdd


This is related to v8 heap allocation on non-windows.  A CFI exception during blink::ScriptWrappableVisitor while stack tracing.  Crash-type says "bad cast", but have a look at the stack in the detailed report and the run-time error.

Feel free to adjust labels and re-assign as appropriate.

Thanks!

Thanks, that looks like one of the remaining rare crashers one crash/. Will have a look as soon as possible.

I doubt it's security status though since it looks like we crash because of a nullptr, which obviously is a bad cast.

Also, it's very likely not related to sigbjornf@ CLs.

 Issue 676850  has been merged into this issue.

ClusterFuzz has detected this issue as fixed in range 440627:440645.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6671083655921664

Fuzzer: therealholden_worker
Job Type: linux_cfi_chrome
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0x000000000000
Crash State:
  Bad-cast to blink::TraceWrapperBase from invalid vptr
  blink::ScriptWrappableVisitor::dispatchTraceWrappers
  blink::ScriptWrappableVisitor::AdvanceTracing
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_chrome&range=439808:439921
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_chrome&range=440627:440645

Minimized Testcase (4.46 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97Ccq18-IHPgI8ZZUa1n3i3LiOyn3ogJmdC1wwllsvCaqXy41bYIKforWldceQ_EZ05TvvquIYQnUs5-alazFKkvsnuMbxRhMFgpEWs2HzrIbsZLGbwGA5YScbX2qab8Ly1mrYkUS4W7Q2jmZzJM9ahGQ668w?testcase_id=6671083655921664

Additional requirements: Requires HTTP

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5677163530682368 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot