New issue
Advanced search Search tips

Issue 683579 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jan 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

V8 correctness failure in configs: x64,fullcode:x64,ignition_turbo

Project Member Reported by ClusterFuzz, Jan 21 2017

Issue description

Owner: machenb...@chromium.org
Status: Assigned (was: Untriaged)
NaN patterns in typed float arrays.
Project Member

Comment 2 by bugdroid1@chromium.org, Jan 24 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/f94c7e8f1a951f6f54a5f629b872404ea9bd16c1

commit f94c7e8f1a951f6f54a5f629b872404ea9bd16c1
Author: machenbach <machenbach@chromium.org>
Date: Tue Jan 24 10:15:55 2017

[foozzie] Disable optimizations for typed float arrays.

This disables optimizations when using typed float arrays in
correctness fuzzer test cases. Otherwise, different NaN patterns
in float typed arrays might lead to different observations when
using the buffer in an int array view.

BUG= chromium:683579 
NOTRY=true
TBR=Jarin, mvstanton, Igor Sheludko

Review-Url: https://codereview.chromium.org/2649923008
Cr-Commit-Position: refs/heads/master@{#42626}

[modify] https://crrev.com/f94c7e8f1a951f6f54a5f629b872404ea9bd16c1/tools/foozzie/v8_mock.js

Project Member

Comment 3 by ClusterFuzz, Jan 24 2017

ClusterFuzz has detected this issue as fixed in range 42625:42626.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5657670263767040

Fuzzer: foozzie_js_mutation
Job Type: foozzie_fullcode_ignition_turbo
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,fullcode:x64,ignition_turbo
  sources: cdc
  
Sanitizer: address (ASAN)

Fixed: V8: 42625:42626

Minimized Testcase (4.02 Kb): https://cluster-fuzz.appspot.com/download/AMIfv950LodI9PGVwrc1gK1JwnWKyzj1ccy7c5O8qxrzBlVS91ylSYrzo7yqkBew6uD1cdwHj_BrQovuXB1C8XhrbBVBeW7KEHpgkiHKLHMqC5KxZUEqtbjuQNyyrpuIcYfFBvbxcp8qiXmf69IfrqkrqK1HJ5v_6Mhm1ydXSJ84cN4MC6wFcsQu36PDr_f_HrTQmBSmwWNBlb98wm9TjHpz9N-Yf_2QhUNT7qsqrvXr-wapCNWQHP-RJPpdnQwvS7ePsXgDJTHO0RvbLMDsI26y8DPBg5u76ydfYIxy01FYNgAvaMC-_9bburjslFixQQH98zoZcmRpLi4OffSlj7CG-EH58PJhOPAIefXq-NRUhxIPnQyZCMQ?testcase_id=5657670263767040

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 4 by ClusterFuzz, Jan 24 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5657670263767040 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment