New issue
Advanced search Search tips

Issue 684004 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Closed: Feb 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Failed Unittest (ValueSerializerTestWithHostObject.RoundTripSameObject)

Reported by leanderz...@gmail.com, Jan 23 2017

Issue description

UserAgent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:47.0) Gecko/20100101 Firefox/47.0

Steps to reproduce the problem:
1. This is a bug reported by our static analysis tool.
2. v8/test/unittests:unittests is compiled.
3. After executing unit_tests, we got the following error.

../../v8/test/unittests/value-serializer-unittest.cc:167: Failure
Value of: deserializer.ReadValue(context).ToLocal(&result)
  Actual: false
Expected: true
[  FAILED  ] ValueSerializerTestWithHostObject.RoundTripSameObject (1 ms)

What is the expected behavior?
Should pass the test.

What went wrong?
In function Maybe<uint32_t> ValueDeserializer::ReadJSObjectProperties, both fast and slow paths are implemented. In the fast path, when the output parameter "success" of LookupIterator::PropertyOrElement is false. The fast path failed and caused the bug. A possible fix could be that if the fast path fails it should fall back to slow path or a better implementation of the fault handler.

Did this work before? N/A 

Chrome version: Version 57.0.2981.0 (64-bit)  Channel: n/a
OS Version: Linux 4.2.0 Ubuntu
Flash Version:
 
Labels: Needs-Triage-M57
Labels: TE-NeedsTriageHelp
This issue seems to be out of TE-scope. Hence, marking TE-NeedsTriageHelp for further investigation.

Thanks...!!
Components: -Platform>DevTools Blink>JavaScript
Owner: jbroman@chromium.org
Status: Assigned (was: Unconfirmed)
Assigning to you because you made a lot of changes recently to the relevant file.
I'm not able to reproduce this failure; how are you getting it to fail? The "success" value is checked in both uses of PropertyOrElement.
To generate the bug, our tool added the following the code to test how the software handles exceptions when success is returned as false. 

+success=false;
if(!success ||

Below is the bug report. Why ValueSerializerTestWithHostObject.RoundTripSameObject failed while others passed the test?

[----------] 5 tests from ValueSerializerTestWithHostObject
[ RUN      ] ValueSerializerTestWithHostObject.RoundTripUint32
[       OK ] ValueSerializerTestWithHostObject.RoundTripUint32 (2 ms)
[ RUN      ] ValueSerializerTestWithHostObject.RoundTripUint64
[       OK ] ValueSerializerTestWithHostObject.RoundTripUint64 (1 ms)
[ RUN      ] ValueSerializerTestWithHostObject.RoundTripDouble
[       OK ] ValueSerializerTestWithHostObject.RoundTripDouble (2 ms)
[ RUN      ] ValueSerializerTestWithHostObject.RoundTripRawBytes
[       OK ] ValueSerializerTestWithHostObject.RoundTripRawBytes (1 ms)
[ RUN      ] ValueSerializerTestWithHostObject.RoundTripSameObject
../../v8/test/unittests/value-serializer-unittest.cc:178: Failure
Value of: deserializer.ReadValue(context).ToLocal(&result)
  Actual: false
Expected: true
[  FAILED  ] ValueSerializerTestWithHostObject.RoundTripSameObject (1 ms)
                      Runtime Function/C++ Builtin        Time             Count
========================================================================================
                                   API_Context_New      4.18ms  58.15%        10   0.29%
                                   CompileFullCode      0.44ms   6.06%        30   0.86%
                              ObjectDefineProperty      0.22ms   3.03%        40   1.15%
                                     CompileScript      0.18ms   2.54%        22   0.63%
                GenericNamedPropertySetterCallback      0.17ms   2.39%       140   4.01%
                              ParseFunctionLiteral      0.14ms   1.93%         8   0.23%







Status: WontFix (was: Assigned)
The serializer is supposed to fail if LookupIterator::PropertyOrElement does. The test failure occurs because your tool introduced a bug.

Sign in to add a comment