New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 739655 link

Starred by 2 users
Status: WontFix
Owner:
jbroman@chromium.org
Closed: Jul 2017
Cc:
█ msrchandra@chromium.org
jbroman@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Out-of-memory in v8_serialized_script_value_fuzzer

Project Member Reported by ClusterFuzz, Jul 6 2017 
Detailed report: https://clusterfuzz.com/testcase?key=5321437983539200

Fuzzer: libFuzzer_v8_serialized_script_value_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Out-of-memory (exceeds 2048 MB)
Crash Address: 
Crash State:
  v8_serialized_script_value_fuzzer
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=424448:424536

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5321437983539200


Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

Comment 1 by msrchandra@chromium.org, Jul 6 2017

Cc: msrchandra@chromium.org
Labels: M-61 Test-Predator-Wrong
Owner: jbroman@chromium.org
Status: Assigned (was: Untriaged)
Predator did not provide any possible suspects.
Assigning to concern owner from CL --
https://chromium.googlesource.com/chromium/src/+log/f8b73903e68fcff233d652da911666d08653ce45..7c742ced7137db2e6785822d2a2f8299178b3537?pretty=fuller

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/c2b1c95b3688cd279bf99977d1323f07b80cce88

@jbroman -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Comment 2 by jbroman@chromium.org, Jul 11 2017

Components: Blink>Messaging
Well, yeah, the issue doesn't repro before the fuzzer existed. :P Looking.

Comment 3 by jbroman@chromium.org, Jul 11 2017

Status: WontFix (was: Assigned)
The fuzzer continues to detect that it's possible to ask for a really massive array. V8 has intentionally chosen to respect this when script asks for it rather than going to dictionary elements, so WontFix.
Project Member

Comment 4 by ClusterFuzz, Jul 19 2017

Labels: Needs-Feedback
ClusterFuzz testcase 5321437983539200 is still reproducing on tip-of-tree build (trunk).

If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase.

Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace.
►

Sign in to add a comment