Issue metadata
Sign in to add a comment
|
CHECK failure: !v8::internal::FLAG_enable_slow_asserts || (object->IsString()) in string-inl.h |
||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5580154297647104 Fuzzer: mbarbella_js_mutation Job Type: linux_asan_d8_dbg Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: !v8::internal::FLAG_enable_slow_asserts || (object->IsString()) in string-inl.h cast v8::internal::__RT_impl_Runtime_DynamicImportCall Sanitizer: address (ASAN) Regressed: V8: 46485:46486 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5580154297647104 Issue manually filed by: ishell See https://github.com/google/clusterfuzz-tools for more information.
,
Jul 20 2017
,
Jul 20 2017
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it. If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jul 20 2017
,
Jul 20 2017
Issue 746910 has been merged into this issue.
,
Jul 20 2017
Updating label since this is off by default
,
Jul 21 2017
,
Jul 26 2017
,
Aug 14 2017
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/f6e20fcbbaf5bc9f43c09305ed39708775fef169 commit f6e20fcbbaf5bc9f43c09305ed39708775fef169 Author: Sathya Gunasekaran <gsathya@chromium.org> Date: Mon Aug 14 23:21:49 2017 [modules] Fix dynamic import in eval In the case of a function constructor or eval, we create a new script object which doesn't have a script name. In this case, we traverse upwards on the list of SFI's through script->eval_from_shared() to get the outermost script that was not an eval script and get the script name from that script. Bug: chromium:746909 , v8:6683 , v8:5785 Change-Id: I430459f632a0e3b18fc3111a5cf1c00cedb9f520 Reviewed-on: https://chromium-review.googlesource.com/606701 Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by: Adam Klein <adamk@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#47352} [modify] https://crrev.com/f6e20fcbbaf5bc9f43c09305ed39708775fef169/src/runtime/runtime-module.cc [add] https://crrev.com/f6e20fcbbaf5bc9f43c09305ed39708775fef169/test/mjsunit/harmony/modules-import-16.js [add] https://crrev.com/f6e20fcbbaf5bc9f43c09305ed39708775fef169/test/mjsunit/regress/regress-746909.js
,
Aug 15 2017
ClusterFuzz testcase 5580154297647104 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Aug 15 2017
,
Nov 21 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by ishell@chromium.org
, Jul 20 2017Owner: gsat...@chromium.org
Status: Assigned (was: Untriaged)