New issue
Advanced search Search tips

Issue 778962 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Nov 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

V8 correctness failure in configs: x64,ignition:ia32,ignition

Project Member Reported by ClusterFuzz, Oct 27 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6482359636721664

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition:ia32,ignition
  sources: fc4
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=v8_foozzie&range=48949:48950

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6482359636721664

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Cc: yangguo@chromium.org jgruber@chromium.org
Labels: -Pri-1 Pri-2
Status: Available (was: Untriaged)
Similar to  issue 689877 . The regexp runs into a stack overflow, which is caught, but still influences program execution. This can't be suppressed and would need to be added to the --abort_on_stack_or_string_length_overflow flag.
Project Member

Comment 2 by ClusterFuzz, Oct 31 2017

Labels: Test-Predator-AutoOwner
Owner: machenb...@chromium.org
Status: Assigned (was: Available)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/98e26799ec9677e53a4dec16210ad8d00f75495c ([foozzie] Fix architecture auto-detect with multi-arch builds).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
Labels: -Test-Predator-AutoOwner Test-Predator-Wrong-CLs
Owner: ----
Status: Available (was: Assigned)
Cc: -jgruber@chromium.org
Owner: jgruber@chromium.org
Status: Fixed (was: Available)
Project Member

Comment 5 by bugdroid1@chromium.org, Nov 2 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/759cfaa2badea88fbce92f5acb5e648a362492ba

commit 759cfaa2badea88fbce92f5acb5e648a362492ba
Author: Jakob Gruber <jgruber@chromium.org>
Date: Thu Nov 02 14:00:24 2017

[regexp] Abort on compilation overflow if flag passed

Abort execution on stack overflow during compilation if
--abort-on-stack-or-string-length-overflow was passed (for correctness
fuzzer support).

Bug:  chromium:778962 
Change-Id: Idd50b47c4ddc03b7839ce850da95502fce4cc848
Reviewed-on: https://chromium-review.googlesource.com/750842
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49079}
[modify] https://crrev.com/759cfaa2badea88fbce92f5acb5e648a362492ba/src/regexp/jsregexp.cc

Project Member

Comment 6 by ClusterFuzz, Nov 3 2017

ClusterFuzz has detected this issue as fixed in range 49078:49079.

Detailed report: https://clusterfuzz.com/testcase?key=6482359636721664

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition:ia32,ignition
  sources: fc4
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=v8_foozzie&range=48949:48950
Fixed: https://clusterfuzz.com/revisions?job=v8_foozzie&range=49078:49079

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6482359636721664

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Nov 3 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 6482359636721664 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment