Crash in v8::internal::Accessors::ErrorStackGetter |
||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5118667772919808 Fuzzer: v8_builtins_generator Job Type: linux_asan_d8_v8_arm_dbg Platform Id: linux Crash Type: UNKNOWN Crash Address: 0xf1d54346 Crash State: v8::internal::Accessors::ErrorStackGetter v8::internal::PropertyCallbackArguments::Call v8::internal::Object::GetPropertyWithAccessor Sanitizer: address (ASAN) Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv95_JSBnSROBJ5T04HzPqE8rS_Dq9EHmDM5VbzOm1sgJY58h5oj0Cy8HTgVUCHT-sSN2DcGWALy4mExOe3LPVAlp4EQ60BUCFs3Mj-U2zsEGtduLQXxt_FwnKXtpnqVZh5utJbMDdUbMdjCnJZYo7R4LIS_65CwMXE8C0Z6ck1mVKUjNgwvYun3H38230TeGAOTlKji2bU8cZvtTS5tM9gJJ6LfmChNVppDhU6ecxuYv_koKyYQ8Y4EXtKv-3IgN3_LIKrcN-3o-ufsuBAlObXsGZSyZAt-gXfz50tflvm0pjE_RUcSJk5gqlU5-JLY8SPZQUp8BigrSanZUyAXYGUleicMHdZmx0jv9an1IfqZH0Fup4gUNL05dhoY2t-nLUMhlczFSohLcXcR3mW7qOg3xALq33A?testcase_id=5118667772919808 Issue manually filed by: rossberg See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Feb 20 2017
Jakob agreed to take a look. Thanks!
,
Feb 20 2017
This one is subtle.. ErrorStackGetter gets the receiver and calls Utils::OpenHandle on it [0]. info.This() returns a Local<Object>, which makes the compiler select the OpenHandle<JSReceiver> overload - and that fails for a Smi receiver. Got a CL in flight. https://cs.chromium.org/chromium/src/v8/src/accessors.cc?q=accessors.+package:%5Echromium$&l=1205
,
Feb 20 2017
,
Feb 20 2017
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/3acc00a0176af5d36f251cd993f49e5db938553f commit 3acc00a0176af5d36f251cd993f49e5db938553f Author: jgruber <jgruber@chromium.org> Date: Mon Feb 20 11:48:10 2017 [regexp] Fix smi receiver in stack accessors info.This returns a Local<Object>, which results in a call to Utils::OpenHandle<JSReceiver>. Casting to a Local<Value> first uses the correct OpenHandle<Object> overload. BUG= chromium:693500 Review-Url: https://codereview.chromium.org/2706833002 Cr-Commit-Position: refs/heads/master@{#43314} [modify] https://crrev.com/3acc00a0176af5d36f251cd993f49e5db938553f/src/accessors.cc [add] https://crrev.com/3acc00a0176af5d36f251cd993f49e5db938553f/test/mjsunit/regress/regress-693500.js
,
Feb 21 2017
Your change meets the bar and is auto-approved for M57. Please go ahead and merge the CL to branch 2987 manually. Please contact milestone owner if you have questions. Owners: amineer@(clank), cmasso@(bling), ketakid@(cros), govind@(desktop) For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Feb 21 2017
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/4631a23092dd903421e770fd8442e051c73cec6b commit 4631a23092dd903421e770fd8442e051c73cec6b Author: jgruber <jgruber@chromium.org> Date: Tue Feb 21 14:53:20 2017 Merged: [regexp] Fix smi receiver in stack accessors Revision: 3acc00a0176af5d36f251cd993f49e5db938553f BUG= chromium:693500 LOG=N NOTRY=true NOPRESUBMIT=true NOTREECHECKS=true TBR=yangguo@chromium.org Review-Url: https://codereview.chromium.org/2707933003 . Cr-Commit-Position: refs/branch-heads/5.7@{#124} Cr-Branched-From: 975e9a320b6eaf9f12280c35df98e013beb8f041-refs/heads/5.7.492@{#1} Cr-Branched-From: 8d76f0e3465a84bbf0bceab114900fbe75844e1f-refs/heads/master@{#42426} [modify] https://crrev.com/4631a23092dd903421e770fd8442e051c73cec6b/src/accessors.cc [add] https://crrev.com/4631a23092dd903421e770fd8442e051c73cec6b/test/mjsunit/regress/regress-693500.js
,
Feb 21 2017
|
||||||
►
Sign in to add a comment |
||||||
Comment 1 by mstarzinger@chromium.org
, Feb 20 2017