New issue
Advanced search Search tips

Issue 746909 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Aug 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security

Blocked on:
issue v8:6620



Sign in to add a comment

CHECK failure: !v8::internal::FLAG_enable_slow_asserts || (object->IsString()) in string-inl.h

Project Member Reported by ClusterFuzz, Jul 20 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5580154297647104

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !v8::internal::FLAG_enable_slow_asserts || (object->IsString()) in string-inl.h
  cast
  v8::internal::__RT_impl_Runtime_DynamicImportCall
  
Sanitizer: address (ASAN)

Regressed: V8: 46485:46486

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5580154297647104


Issue manually filed by: ishell

See https://github.com/google/clusterfuzz-tools for more information.
 

Comment 1 by ishell@chromium.org, Jul 20 2017

Cc: neis@chromium.org adamk@chromium.org
Owner: gsat...@chromium.org
Status: Assigned (was: Untriaged)
CF points to d9cb6135fe16e33278e369398d2bce8f885c31db. PTAL
Project Member

Comment 2 by sheriffbot@chromium.org, Jul 20 2017

Labels: M-61
Project Member

Comment 3 by sheriffbot@chromium.org, Jul 20 2017

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 4 by sheriffbot@chromium.org, Jul 20 2017

Labels: Pri-1

Comment 5 by ishell@chromium.org, Jul 20 2017

 Issue 746910  has been merged into this issue.
Labels: -Security_Impact-Head -Security_Severity-High -ReleaseBlock-Stable Security_Impact-None Security_Severity-Low
Updating label since this is off by default
Labels: -M-61
Blockedon: v8:6620
Project Member

Comment 9 by bugdroid1@chromium.org, Aug 14 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/f6e20fcbbaf5bc9f43c09305ed39708775fef169

commit f6e20fcbbaf5bc9f43c09305ed39708775fef169
Author: Sathya Gunasekaran <gsathya@chromium.org>
Date: Mon Aug 14 23:21:49 2017

[modules] Fix dynamic import in eval

In the case of a function constructor or eval, we create a new script
object which doesn't have a script name. In this case, we traverse
upwards on the list of SFI's through script->eval_from_shared() to get
the outermost script that was not an eval script and get the script
name from that script.

Bug:  chromium:746909 ,  v8:6683 ,  v8:5785 
Change-Id: I430459f632a0e3b18fc3111a5cf1c00cedb9f520
Reviewed-on: https://chromium-review.googlesource.com/606701
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47352}
[modify] https://crrev.com/f6e20fcbbaf5bc9f43c09305ed39708775fef169/src/runtime/runtime-module.cc
[add] https://crrev.com/f6e20fcbbaf5bc9f43c09305ed39708775fef169/test/mjsunit/harmony/modules-import-16.js
[add] https://crrev.com/f6e20fcbbaf5bc9f43c09305ed39708775fef169/test/mjsunit/regress/regress-746909.js

Project Member

Comment 10 by ClusterFuzz, Aug 15 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5580154297647104 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 11 by sheriffbot@chromium.org, Aug 15 2017

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 12 by sheriffbot@chromium.org, Nov 21 2017

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment