New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 692273 link

Starred by 1 user
Status: Duplicate
Merged: issue v8:5911
Owner:
█ mtrofin@chromium.org
Last visit > 30 days ago
Closed: Feb 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in v8::internal::compiler::RegisterAllocatorVerifier::ValidateFinalAssessment

Project Member Reported by ClusterFuzz, Feb 14 2017 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6080637904879616

Fuzzer: libfuzzer_v8_wasm_code_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x7f5af83c5228
Crash State:
  v8::internal::compiler::RegisterAllocatorVerifier::ValidateFinalAssessment
  v8::internal::compiler::RegisterAllocatorVerifier::ValidatePendingAssessment
  v8::internal::compiler::RegisterAllocatorVerifier::ValidateFinalAssessment
  
Sanitizer: address (ASAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=446341:446455

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97MYbNn2KKaXyIjEXvAmLRyjED2hF0mFu9r32UvnKq2TlkITmpP6CJpu9SykJfIFlZLYbbZ1YjboS9Dg01jj8J-z7ETJToGge2l8L24g-HN51lH-o9IShWmpNPzMUgfK_Q-2YuGLlRXLMfdiG7pXosbs-VVh6NLxXynzkRsBKwcOrN4q68XRFVcyxtf-fQiv3kuULfwLMAZuUJZWjcA3ULA69CU900e0ensNfTO34zQCTbOwNahPzo2T1BTXZAU4hRXRFaQftg7m_o0eZLcb03nu3QWdoqMaI6BALNE0hfbYGMzITmXJbPlPF8-Zpdm_L_t6-kFztIxXUxR3VL7BYsj3y9YOg42JiX720jWlulhVPz_6zntSYAr7636CleA2eokICeVmQlYQmf7Y1AK3PZXMQeFlg?testcase_id=6080637904879616


Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

Comment 1 by msrchandra@chromium.org, Feb 15 2017

Components: Blink>JavaScript

Comment 2 by rossberg@chromium.org, Feb 15 2017

Owner: mtrofin@chromium.org
Status: Assigned (was: Untriaged)

Comment 3 by mtrofin@chromium.org, Feb 16 2017

Status: Started (was: Assigned)
I believe this is what https://codereview.chromium.org/2667963004 fixes, but I'll validate shortly.

Comment 4 by mtrofin@chromium.org, Feb 28 2017

Mergedinto: v8:5911
Status: Duplicate (was: Started)
Project Member

Comment 5 by ClusterFuzz, Mar 8 2017 

ClusterFuzz has detected this issue as fixed in range 455091:455226.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6080637904879616

Fuzzer: libfuzzer_v8_wasm_code_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x7f5af83c5228
Crash State:
  v8::internal::compiler::RegisterAllocatorVerifier::ValidateFinalAssessment
  v8::internal::compiler::RegisterAllocatorVerifier::ValidatePendingAssessment
  v8::internal::compiler::RegisterAllocatorVerifier::ValidateFinalAssessment
  
Sanitizer: address (ASAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=446341:446455
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan_debug&range=455091:455226

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97MYbNn2KKaXyIjEXvAmLRyjED2hF0mFu9r32UvnKq2TlkITmpP6CJpu9SykJfIFlZLYbbZ1YjboS9Dg01jj8J-z7ETJToGge2l8L24g-HN51lH-o9IShWmpNPzMUgfK_Q-2YuGLlRXLMfdiG7pXosbs-VVh6NLxXynzkRsBKwcOrN4q68XRFVcyxtf-fQiv3kuULfwLMAZuUJZWjcA3ULA69CU900e0ensNfTO34zQCTbOwNahPzo2T1BTXZAU4hRXRFaQftg7m_o0eZLcb03nu3QWdoqMaI6BALNE0hfbYGMzITmXJbPlPF8-Zpdm_L_t6-kFztIxXUxR3VL7BYsj3y9YOg42JiX720jWlulhVPz_6zntSYAr7636CleA2eokICeVmQlYQmf7Y1AK3PZXMQeFlg?testcase_id=6080637904879616


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
►

Sign in to add a comment