Issue metadata
Sign in to add a comment
|
Null-dereference READ in v8::internal::FeedbackVector::GetKind |
||||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5050900078133248 Fuzzer: inferno_layout_test_fuzzer Job Type: windows_asan_content_shell Platform Id: windows Crash Type: Null-dereference READ Crash Address: 0x0000002b Crash State: v8::internal::FeedbackVector::GetKind v8::internal::Runtime_LoadIC_Miss v8::internal::Invoke Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=511620:511668 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5050900078133248 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Nov 8 2017
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/834f5adf5e05b4c3fe622a7e70916bd38b96baaa ([wasm] Integrate Liftoff in the compilation pipeline). If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
,
Nov 8 2017
Liftoff cannot have caused this failure.
,
Nov 8 2017
,
Nov 14 2017
As this week's ClusterFuzz sheriff, I investigated a bit more. On a local Debug+ASan build, I can reproduce this. Instead of a crash, I get a CSA_ASSERT failure: abort: CSA_ASSERT failed: IsFeedbackVector(vector) [../../v8/src/ic/accessor-assembler.cc:33] It bisects to c63dcad855a5dcf1faeb1287883300ddf6c244ad (DevTools: re-use new test helper modules for legacy test framework). Even though this CL changes something in the content shell, it looks quite innocent to me. CC'ing chanwilliam anyway, maybe he can help here. Michael, can you help triaging this further? How to reproduce: $› git checkout c63dcad855a5dcf1faeb1287883300ddf6c244ad HEAD is now at c63dcad855a5... DevTools: re-use new test helper modules for legacy test framework $› cat out/Debug.asan/args.gn is_debug = true v8_optimized_debug = false v8_enable_slow_dchecks = true use_goma = true is_component_build = true is_asan = true $› gclient sync && ninja -C out/Debug.asan -j1000 content_shell Syncing projects: 100% (106/106), done. Running hooks: 50% (32/64) fetch_telemetry_binary_dependencies ________ running '/usr/bin/python src/tools/perf/conditionally_execute --gyp-condition fetch_telemetry_dependencies=1 src/third_party/catapult/telemetry/bin/fetch_telemetry_binary_dependencies' in '/usr/local/google/home/clemensh/chromium' Not found "fetch_telemetry_dependencies=1" condition in GYP_DEFINES="['use_goma=1', 'linux_use_debug_fission=0', 'component=shared_library', 'v8_target_arch=x64', 'target_arch=x64']". Skip script execution. Running hooks: 100% (64/64), done. ninja: Entering directory `out/Debug.asan' ninja: no work to do. $› export ASAN_OPTIONS=redzone=32:handle_sigill=1:strict_string_check=1:allocator_release_to_os_interval_ms=500:strict_memcmp=1:allow_user_segv_handler=0:coverage=0:allocator_may_return_null=1:use_sigaltstack=1:detect_stack_use_after_return=1:alloc_dealloc_mismatch=0:print_scariness=1:max_uar_stack_size_log=16:handle_abort=1:check_malloc_usable_size=0:detect_container_overflow=1:quarantine_size_mb=10:detect_odr_violation=0:symbolize=0:handle_segv=1:fast_unwind_on_fatal=1 $› out/Debug.asan/content_shell --use-gl=swiftshader --run-layout-test --dump-render-tree --enable-features=V8Future ~/Downloads/inputs/fuzzer-common-data-bundles/layouttests/http/tests/devtools/coverage/fuzz-lyt-coverage-view-filter1510103361.12.html #READY DevTools listening on ws://127.0.0.1:41701/devtools/browser/2d9b1fce-9f7c-4005-8d0d-a9d6cf71dc27 [22908:22908:1114/181051.077988:2364280757884:ERROR:gpu_info.cc(103)] No active GPU found, returning primary GPU. * vector: 0x7f05654822e1 <undefined> abort: CSA_ASSERT failed: IsFeedbackVector(vector) [../../v8/src/ic/accessor-assembler.cc:33] ==== JS stack trace ========================================= [...]
,
Nov 16 2017
,
Dec 15 2017
Can we get another bisect for this? Re-reviewed my change and don't see how it would cause an ASAN issue.
,
Dec 15 2017
Now the CF report is saying "Reproducible:NO", might be a flaky? +mmoroz@ for further inputs. FYI: We are tracking all these kind of "Reproducible --> Non-Reproducible" reports here: crbug.com/771272 Thank you!
,
Dec 19 2017
Gentle ping on this.
,
Dec 19 2017
,
Dec 20 2017
ClusterFuzz testcase 5050900078133248 is flaky and no longer crashes, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Dec 20 2017
|
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by ClusterFuzz
, Nov 8 2017Labels: Test-Predator-Auto-Components