Crash in v8::internal::JSObject::WriteToField |
||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=4585218003697664 Fuzzer: libfuzzer_v8_json_parser_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: UNKNOWN Crash Address: 0x7f83f3cc3148 Crash State: v8::internal::JSObject::WriteToField v8::internal::JsonParser<true>::CommitStateToJsonObject v8::internal::JsonParser<true>::ParseJsonObject Sanitizer: address (ASAN) Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=445279:445286 Minimized Testcase (1.47 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94YrpGKk576q-K10V0DwM7RfeKTPE9wempel0pfGNaFDAbOqAGE2yCNXieDObrCe4MpMRVA3WUa74211FAREwsmya6egJtqBE8uldsdLe7gNix2j72hJcZgnS8u_9sM6B_-neFQdKyPqiNicdEr99DhpQLDhBlWYTB3-CW93FXMJJ3HdeiIzOQASNUSe7tIDvsqOXocAmG5hkVMoHq0WAh3__Tq29up7w-pVekcDkwmoU5rwdnGZoXF7tN1va5HPxf-fli045w1HbTkf8OxEJ2PWOSOTjSItGDYrGH5ubW2cmwmMvABh69dWv2CeiZnEq49eRX_eT5DTbNuukcBkS-yriqTcrwNiJbrp5ESc0kJa-UzfqY?testcase_id=4585218003697664 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Jan 23 2017
Providing the Find it results -- The result is a list of CLs that change the crashed files. Author: ishell Project: chromium-v8 Changelist: https://chromium.googlesource.com/v8/v8.git/+/14bf73576c681e4c8b1a03125a3c1837ce557c92 Time: Fri Jan 20 17:56:28 2017 Lines 481, 486 of file json-parser.cc which potentially caused crash are changed in this cl (frame #3, "v8::internal::JsonParser::CommitStateToJsonObject"; frame #6, "v8::internal::JsonParser::ParseJsonObject"). Minimum distance from crash line to modified line: 0. (file: json-parser.cc, crashed on: 481, modified: 481). Thank You.
,
Jan 23 2017
,
Jan 23 2017
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/87d7bb40d68a09a5197192358fb300645f9e3202 commit 87d7bb40d68a09a5197192358fb300645f9e3202 Author: ishell <ishell@chromium.org> Date: Mon Jan 23 12:21:08 2017 Use proper descriptors array when committing state to JSON object. This CL fixes an issue introduced in https://codereview.chromium.org/2645083003. BUG= chromium:683818 Review-Url: https://codereview.chromium.org/2651653002 Cr-Commit-Position: refs/heads/master@{#42602} [modify] https://crrev.com/87d7bb40d68a09a5197192358fb300645f9e3202/src/json-parser.cc
,
Jan 23 2017
,
Jan 24 2017
ClusterFuzz has detected this issue as fixed in range 445411:445545. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4585218003697664 Fuzzer: libfuzzer_v8_json_parser_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: UNKNOWN Crash Address: 0x7f83f3cc3148 Crash State: v8::internal::JSObject::WriteToField v8::internal::JsonParser<true>::CommitStateToJsonObject v8::internal::JsonParser<true>::ParseJsonObject Sanitizer: address (ASAN) Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=445279:445286 Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=445411:445545 Minimized Testcase (1.47 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94YrpGKk576q-K10V0DwM7RfeKTPE9wempel0pfGNaFDAbOqAGE2yCNXieDObrCe4MpMRVA3WUa74211FAREwsmya6egJtqBE8uldsdLe7gNix2j72hJcZgnS8u_9sM6B_-neFQdKyPqiNicdEr99DhpQLDhBlWYTB3-CW93FXMJJ3HdeiIzOQASNUSe7tIDvsqOXocAmG5hkVMoHq0WAh3__Tq29up7w-pVekcDkwmoU5rwdnGZoXF7tN1va5HPxf-fli045w1HbTkf8OxEJ2PWOSOTjSItGDYrGH5ubW2cmwmMvABh69dWv2CeiZnEq49eRX_eT5DTbNuukcBkS-yriqTcrwNiJbrp5ESc0kJa-UzfqY?testcase_id=4585218003697664 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
||||
►
Sign in to add a comment |
||||
Comment 1 by msrchandra@chromium.org
, Jan 23 2017