New issue
Advanced search Search tips

Issue 736700 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 736565
Owner:
Closed: Jul 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security



Sign in to add a comment

CHECK failure: !isolate->has_scheduled_exception() in builtins-console.cc

Project Member Reported by ClusterFuzz, Jun 26 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4802371120267264

Fuzzer: inferno_js_fuzzer
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !isolate->has_scheduled_exception() in builtins-console.cc
  v8::internal::ConsoleCall
  v8::internal::Builtin_ConsoleLog
  
Sanitizer: address (ASAN)

Regressed: V8: 44853:44854

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4802371120267264


Issue manually filed by: ishell

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Owner: yangguo@chromium.org
Status: Assigned (was: Untriaged)

Comment 2 by aarya@google.com, Jun 26 2017

Does it have security implications, if not please change to Type-Bug and remove Restrict-View-SecurityTeam
Project Member

Comment 3 by sheriffbot@chromium.org, Jun 26 2017

Labels: M-61
Project Member

Comment 4 by sheriffbot@chromium.org, Jun 26 2017

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 5 by sheriffbot@chromium.org, Jun 26 2017

Labels: Pri-1
Project Member

Comment 6 by sheriffbot@chromium.org, Jul 10 2017

yangguo: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 7 by gov...@chromium.org, Jul 11 2017

A friendly reminder that M61 branch is coming soon on 07/20! Your bug is labelled as Stable ReleaseBlock, pls make sure to land the fix ASAP to trunk. This way we branch M61 from a high quality trunk. Thank you.
Project Member

Comment 8 by sheriffbot@chromium.org, Jul 24 2017

yangguo: Uh oh! This issue still open and hasn't been updated in the last 28 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Mergedinto: 736565
Status: Duplicate (was: Assigned)
Project Member

Comment 10 by ClusterFuzz, Aug 4 2017

ClusterFuzz has detected this issue as fixed in range 47140:47141.

Detailed report: https://clusterfuzz.com/testcase?key=4802371120267264

Fuzzer: inferno_js_fuzzer
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !isolate->has_scheduled_exception() in builtins-console.cc
  v8::internal::ConsoleCall
  v8::internal::Builtin_ConsoleLog
  
Sanitizer: address (ASAN)

Regressed: V8: 44853:44854
Fixed: V8: 47140:47141

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4802371120267264


See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by sheriffbot@chromium.org, Nov 11 2017

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment