New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 707550 link

Starred by 5 users

Issue metadata

Status: Archived
Owner:
Closed: Dec 27
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

V8 correctness failure in configs: x64,ignition_turbo:ia32,ignition_turbo

Project Member Reported by ClusterFuzz, Apr 2 2017

Issue description

Cc: mvstan...@chromium.org mstarzinger@chromium.org danno@chromium.org
Labels: -Pri-1 Pri-2
Status: Available (was: Untriaged)
Known unstable sort problem. Points to https://chromium.googlesource.com/v8/v8/+/1fe5f0e3adcc447260d8ce88e01f6482eb9d9725
@mvstanton, you recently checked in something that made those problems go away, with the above commit they come back. Is there a (simple) way to make it equal for ia32 and x64 so that the correctness fuzzer isn't noisy about it?

// Simple repro:

var __v_2 = {};
__v_0 = [1, 2];
__v_0[0xffff] = 4;
__v_0.sort(function() {})
print(__v_0[0]);

// Output:
# Compared x64,ignition with ia32,ignition
#
# Flags of x64,ignition:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --es-staging --random-seed 732681078 --ignition --turbo-filter=~ --hydrogen-filter=~ --nocrankshaft
# Flags of ia32,ignition:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --es-staging --random-seed 732681078 --ignition --turbo-filter=~ --hydrogen-filter=~ --nocrankshaft
#
# Difference:
- 1
+ 2
#
### Start of configuration x64,ignition:
1

### End of configuration x64,ignition
#
### Start of configuration ia32,ignition:
2

### End of configuration ia32,ignition
 Issue 711755  has been merged into this issue.
Project Member

Comment 3 by ClusterFuzz, Apr 25 2017

ClusterFuzz has detected this issue as fixed in range 44792:44793.

Detailed report: https://clusterfuzz.com/testcase?key=6558675557941248

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition_turbo:ia32,ignition_turbo
  sources: 1c2
  
Sanitizer: address (ASAN)

Regressed: V8: 44025:44026
Fixed: V8: 44792:44793

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6558675557941248


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 4 by ClusterFuzz, Apr 25 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Available)
ClusterFuzz testcase 6160373360361472 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Status: Available (was: Verified)
This looks like a random CL that "fixed" this. Looks like not all instances of this are resolved e.g.  issue 716702 
Labels: ClusterFuzz-Wrong
This still repros with HEAD.
Cc: verwa...@chromium.org
 Issue 716702  has been merged into this issue.
Owner: mvstan...@chromium.org
I'll look...
Status: Assigned (was: Available)
Cc: jarin@chromium.org ishell@chromium.org raphael....@intel.com cbruni@chromium.org machenb...@chromium.org
 Issue 690900  has been merged into this issue.
 Issue 723345  has been merged into this issue.
 Issue 724814  has been merged into this issue.
 Issue 739312  has been merged into this issue.
Labels: -ClusterFuzz-Wrong
We have made a bunch of changes on ClusterFuzz side, so resetting ClusterFuzz-Wrong label.
Status: Archived (was: Assigned)

Sign in to add a comment