New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 682090 link

Starred by 0 users

Issue metadata

Status: Verified
Owner: ----
Closed: Jan 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in v8::internal::Invoke

Project Member Reported by ClusterFuzz, Jan 18 2017

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5343778518073344

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8
Platform Id: linux

Crash Type: UNKNOWN WRITE
Crash Address: 0x000000000000
Crash State:
  v8::internal::Invoke
  v8::internal::CallInternal
  v8::internal::Execution::Call
  
Sanitizer: address (ASAN)

Regressed: V8: r42403:42404

Minimized Testcase (0.39 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95ADG7I-IiERaVPWXtw_kD7n32fkghrNWeuqWty-I-KDw65dDWtmN1btqRT12p1Kg7lgFRZLj_zNqLngtjkIirpVwxIHYvgI80oTLNNDPF1N3UDQ2TAjgMRpAeol1fIhTw5os3khMkTLoaGdWoLY71oAEeJGVG3p_A8hBsAHctpNDdNtUejgJSAkuywqOsVc26OjwCQtfGwIq29zgLBeV5VWCs8BwWfcwfMEEi9oIsR7dJvTO4ok9tWZYQXivV74isV0pDocnt2kkzefb6PAYhWWxC1xDuVKogQC9iXKo4qvBL1LyuwvUxlzaAWXsFwGGnazfY1Ye0TEmviDofzifu7RjvJvm6GozhXULJ-Qidm-cJR07Q?testcase_id=5343778518073344
var __v_11 = {};
function __f_66(expected, __f_84, __f_10) {
 __f_84(__v_11, __f_10, new ArrayBuffer()).__f_24();
}
  __f_66(7, __f_120);
  function __f_24() {
  }
 gc(); 
function __f_120(__v_11, __v_40, buffer) {
  "use asm";
  var __v_38 = new __v_11.Int32Array(buffer);
  function __f_24() {
    var __v_35 = 4;
    __v_38[0] = (__v_35 + 1) | 0;
  }
  return {__f_24: __f_24};
}
__f_66(-8, __f_120);


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: msrchandra@chromium.org
Labels: Test-Predator-Wrong-CLs
Owner: jochen@chromium.org
Status: Assigned (was: Untriaged)
Find it did not provide any possible suspects.
Assigning to the concern owner from CL --
https://chromium.googlesource.com/v8/v8/+log/bb71555e2e41678897187f3d0c0f42d742865305..0389df514d48c6394f606bf4e5b9b0b0cb134d1b?pretty=fuller

@jochen -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Comment 2 by jochen@chromium.org, Jan 18 2017

Owner: msrchandra@chromium.org
hey mrschandra@

V8 issues are pretty difficult to triage from looking at the stack alone. If you open the clusterfuzz report, you'll see that the top frames are all not symbolized. Instead of trying to find a culprit by looking at most likely unrelated stack frames below, please follow this handy triaging guide: https://github.com/v8/v8/wiki/Triaging-issues - just apply the correct labels to the bug and wait for our sherifs to pick them up!

thanks
jochen
Cc: hablich@chromium.org
Owner: ----
Status: Available (was: Assigned)
@jochen -- Apologies and thank you for the update.
Will take care going further in assigning v8 related issues.
Project Member

Comment 4 by ClusterFuzz, Jan 19 2017

ClusterFuzz has detected this issue as fixed in range 42478:42479.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5343778518073344

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8
Platform Id: linux

Crash Type: UNKNOWN WRITE
Crash Address: 0x000000000000
Crash State:
  v8::internal::Invoke
  v8::internal::CallInternal
  v8::internal::Execution::Call
  
Sanitizer: address (ASAN)

Regressed: V8: 42403:42404
Fixed: V8: 42478:42479

Minimized Testcase (0.39 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95ADG7I-IiERaVPWXtw_kD7n32fkghrNWeuqWty-I-KDw65dDWtmN1btqRT12p1Kg7lgFRZLj_zNqLngtjkIirpVwxIHYvgI80oTLNNDPF1N3UDQ2TAjgMRpAeol1fIhTw5os3khMkTLoaGdWoLY71oAEeJGVG3p_A8hBsAHctpNDdNtUejgJSAkuywqOsVc26OjwCQtfGwIq29zgLBeV5VWCs8BwWfcwfMEEi9oIsR7dJvTO4ok9tWZYQXivV74isV0pDocnt2kkzefb6PAYhWWxC1xDuVKogQC9iXKo4qvBL1LyuwvUxlzaAWXsFwGGnazfY1Ye0TEmviDofzifu7RjvJvm6GozhXULJ-Qidm-cJR07Q?testcase_id=5343778518073344
var __v_11 = {};
function __f_66(expected, __f_84, __f_10) {
 __f_84(__v_11, __f_10, new ArrayBuffer()).__f_24();
}
  __f_66(7, __f_120);
  function __f_24() {
  }
 gc(); 
function __f_120(__v_11, __v_40, buffer) {
  "use asm";
  var __v_38 = new __v_11.Int32Array(buffer);
  function __f_24() {
    var __v_35 = 4;
    __v_38[0] = (__v_35 + 1) | 0;
  }
  return {__f_24: __f_24};
}
__f_66(-8, __f_120);


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Jan 19 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Available)
ClusterFuzz testcase 5343778518073344 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment