New issue
Advanced search Search tips

Issue 785973 link

Starred by 3 users

Issue metadata

Status: Duplicate
Merged: issue v8:287
Owner:
Closed: Nov 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Timeout in v8_regexp_parser_fuzzer

Project Member Reported by ClusterFuzz, Nov 16 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5949473607122944

Fuzzer: libFuzzer_v8_regexp_parser_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Timeout (exceeds 25 secs)
Crash Address: 
Crash State:
  v8_regexp_parser_fuzzer
  
Sanitizer: memory (MSAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5949473607122944

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. We will auto-close the bug if the crash is not seen for 14 days.
 
Components: Blink>JavaScript
Labels: Test-Predator-Wrong
Owner: jgruber@chromium.org
Status: Assigned (was: Untriaged)
Another interesting pattern which times out: "(7|){3117889}"
Mergedinto: v8:287
Status: Duplicate (was: Assigned)
Again exponential backtracking, with 2^3117889 combinations to try before failing :(

Comment 4 Deleted

Cc: -sunyunjia@chromium.org -ebidel@google.com -majidvp@chromium.org
Cc: -susanjuniab@chromium.org

Sign in to add a comment