New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 782546 link

Starred by 3 users

Issue metadata

Status: Duplicate
Merged: issue 786784
Owner:
Closed: Dec 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug

Blocked on:
issue 771272



Sign in to add a comment

Null-dereference READ in v8::internal::FeedbackVector::GetKind

Project Member Reported by ClusterFuzz, Nov 8 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5050900078133248

Fuzzer: inferno_layout_test_fuzzer
Job Type: windows_asan_content_shell
Platform Id: windows

Crash Type: Null-dereference READ
Crash Address: 0x0000002b
Crash State:
  v8::internal::FeedbackVector::GetKind
  v8::internal::Runtime_LoadIC_Miss
  v8::internal::Invoke
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_content_shell&range=511620:511668

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5050900078133248

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 8 2017

Components: Blink>JavaScript>Runtime
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Nov 8 2017

Labels: Test-Predator-Auto-Owner
Owner: clemensh@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/834f5adf5e05b4c3fe622a7e70916bd38b96baaa ([wasm] Integrate Liftoff in the compilation pipeline).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
Labels: Test-Predator-Wrong
Owner: ----
Status: (was: Assigned)
Liftoff cannot have caused this failure.
Status: Untriaged
Cc: chenwilliam@chromium.org mvstan...@chromium.org
As this week's ClusterFuzz sheriff, I investigated a bit more.
On a local Debug+ASan build, I can reproduce this. Instead of a crash, I get a CSA_ASSERT failure:
abort: CSA_ASSERT failed: IsFeedbackVector(vector) [../../v8/src/ic/accessor-assembler.cc:33]

It bisects to c63dcad855a5dcf1faeb1287883300ddf6c244ad (DevTools: re-use new test helper modules for legacy test framework).
Even though this CL changes something in the content shell, it looks quite innocent to me.
CC'ing chanwilliam anyway, maybe he can help here.

Michael, can you help triaging this further?

How to reproduce:

$› git checkout c63dcad855a5dcf1faeb1287883300ddf6c244ad
HEAD is now at c63dcad855a5... DevTools: re-use new test helper modules for legacy test framework

$› cat out/Debug.asan/args.gn 
is_debug = true
v8_optimized_debug = false
v8_enable_slow_dchecks = true
use_goma = true
is_component_build = true
is_asan = true

$› gclient sync && ninja -C out/Debug.asan -j1000 content_shell
Syncing projects: 100% (106/106), done.                                      
Running hooks:  50% (32/64) fetch_telemetry_binary_dependencies
________ running '/usr/bin/python src/tools/perf/conditionally_execute --gyp-condition fetch_telemetry_dependencies=1 src/third_party/catapult/telemetry/bin/fetch_telemetry_binary_dependencies' in '/usr/local/google/home/clemensh/chromium'
Not found "fetch_telemetry_dependencies=1" condition in GYP_DEFINES="['use_goma=1', 'linux_use_debug_fission=0', 'component=shared_library', 'v8_target_arch=x64', 'target_arch=x64']". Skip script execution.
Running hooks: 100% (64/64), done.                             
ninja: Entering directory `out/Debug.asan'
ninja: no work to do.

$› export ASAN_OPTIONS=redzone=32:handle_sigill=1:strict_string_check=1:allocator_release_to_os_interval_ms=500:strict_memcmp=1:allow_user_segv_handler=0:coverage=0:allocator_may_return_null=1:use_sigaltstack=1:detect_stack_use_after_return=1:alloc_dealloc_mismatch=0:print_scariness=1:max_uar_stack_size_log=16:handle_abort=1:check_malloc_usable_size=0:detect_container_overflow=1:quarantine_size_mb=10:detect_odr_violation=0:symbolize=0:handle_segv=1:fast_unwind_on_fatal=1

$› out/Debug.asan/content_shell --use-gl=swiftshader --run-layout-test --dump-render-tree --enable-features=V8Future ~/Downloads/inputs/fuzzer-common-data-bundles/layouttests/http/tests/devtools/coverage/fuzz-lyt-coverage-view-filter1510103361.12.html                                                                                       
#READY

DevTools listening on ws://127.0.0.1:41701/devtools/browser/2d9b1fce-9f7c-4005-8d0d-a9d6cf71dc27
[22908:22908:1114/181051.077988:2364280757884:ERROR:gpu_info.cc(103)] No active GPU found, returning primary GPU.
 * vector: 0x7f05654822e1 <undefined>
abort: CSA_ASSERT failed: IsFeedbackVector(vector) [../../v8/src/ic/accessor-assembler.cc:33]


==== JS stack trace =========================================
[...]
Owner: chenwilliam@chromium.org
Status: Assigned (was: Untriaged)
Labels: Needs-Bisect
Owner: ----
Status: Untriaged (was: Assigned)
Can we get another bisect for this? Re-reviewed my change and don't see how it would cause an ASAN issue.
Blockedon: 771272
Cc: mmoroz@chromium.org
Labels: -Needs-Bisect
Now the CF report is saying "Reproducible:NO", might be a flaky?

+mmoroz@ for further inputs.

FYI: We are tracking all these kind of "Reproducible --> Non-Reproducible" reports here: crbug.com/771272

Thank you!
Cc: ishell@chromium.org
Status: Available (was: Untriaged)
Gentle ping on this.
Owner: ishell@chromium.org
Status: Started (was: Available)
Project Member

Comment 11 by ClusterFuzz, Dec 20 2017

Status: WontFix (was: Started)
ClusterFuzz testcase 5050900078133248 is flaky and no longer crashes, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Mergedinto: 786784
Status: Duplicate (was: WontFix)

Sign in to add a comment