V8 correctness failure in configs: x64,fullcode:x64,ignition_staging |
||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=6737783436869632 Fuzzer: foozzie_js_mutation Job Type: foozzie_ignition_staging Platform Id: linux Crash Type: V8 correctness failure Crash Address: Crash State: configs: x64,fullcode:x64,ignition_staging sources: 3ee Sanitizer: address (ASAN) Regressed: V8: r42370:42371 Minimized Testcase (0.37 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv96T9OXfatYyG0-SDzfAS1RIttixw57zZudVGtAxdimkXjw2Hffu6FNsEbkXGEVIFz1tcUJ5w5xIbneuqKQOmAoq9Btq0KjW7MR4Z9WhxXnvU9AMmRXid-uQDKZkmLBJK7nO144gqO1jcdpbstqH1VwngDQcKYeytDsbEBD47qkmkVEzGekMtpgpllA2d5focN8W5Kdpz1d9Yi-rweh3hg_YYPuzk_U4j8nk1sCfW6QBJyD-Jg1tukPy9C5HNFY6JRwcc5QqF3MorQRJcg5nkeguvdZ_IiVQ3a3hCkxLobv2WOfniVLoRu2BNkNZl8emGmSSjN_hZuxAx_f2E6mdMIUrmXSGn8GuEdm2Rr9V4NDWe3TqLMo?testcase_id=6737783436869632 __PrettyPrint = function __PrettyPrint() { switch (typeof value) { } } assertEquals = function assertEquals(expected, found) { print(found); }; var __v_4 = undefined; print("v8-foozzie source: /v8/test/mjsunit/compiler/regress-5074.js"); function __f_2(a, b) { return __v_4 + b; } __f_2(); %OptimizeFunctionOnNextCall(__f_2); assertEquals("undefined2", __f_2(0, "2")); Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Jan 18 2017
This seems to be a Crankshaft issues, but only if feedback is collected by Ignition.
,
Jan 20 2017
As discussed, moving to machenbach@ for further triage.
,
Mar 8 2017
ClusterFuzz has detected this issue as fixed in range 43654:43655. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6737783436869632 Fuzzer: foozzie_js_mutation Job Type: foozzie_ignition_staging Platform Id: linux Crash Type: V8 correctness failure Crash Address: Crash State: configs: x64,fullcode:x64,ignition_staging sources: 3ee Sanitizer: address (ASAN) Regressed: V8: 42370:42371 Fixed: V8: 43654:43655 Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96T9OXfatYyG0-SDzfAS1RIttixw57zZudVGtAxdimkXjw2Hffu6FNsEbkXGEVIFz1tcUJ5w5xIbneuqKQOmAoq9Btq0KjW7MR4Z9WhxXnvU9AMmRXid-uQDKZkmLBJK7nO144gqO1jcdpbstqH1VwngDQcKYeytDsbEBD47qkmkVEzGekMtpgpllA2d5focN8W5Kdpz1d9Yi-rweh3hg_YYPuzk_U4j8nk1sCfW6QBJyD-Jg1tukPy9C5HNFY6JRwcc5QqF3MorQRJcg5nkeguvdZ_IiVQ3a3hCkxLobv2WOfniVLoRu2BNkNZl8emGmSSjN_hZuxAx_f2E6mdMIUrmXSGn8GuEdm2Rr9V4NDWe3TqLMo?testcase_id=6737783436869632 See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Mar 8 2017
ClusterFuzz testcase 6737783436869632 is verified as fixed, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Mar 8 2017
,
Mar 10 2017
,
Mar 10 2017
,
Sep 18 2017
We have made a bunch of changes on ClusterFuzz side, so resetting ClusterFuzz-Wrong label. |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by machenb...@chromium.org
, Jan 18 2017Labels: v8-foozzie-failure
# PTAL! Calling with or without --ignition-staging is enough. Simple repro: function foo(a) { return undefined + a; } foo(); %OptimizeFunctionOnNextCall(foo); print(foo("2")); # Difference: - undefined2 + NaN2