New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 792105 link

Starred by 1 user
Status: Fixed
Owner:
mlippautz@chromium.org
Closed: Dec 2017
Cc:
█ hpayer@chromium.org
u...@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 1
Type: Bug

Blocking:
issue 791043



Sign in to add a comment

browser_tests on Linux_CFI ar failing since Since Update V8 to version 6.5.5.1

Project Member Reported by markusheintz@chromium.org, Dec 5 2017 
Since "Update V8 to version 6.5.5.1 (cherry-pick)": https://chromium.googlesource.com/chromium/src/+/4b549f06792e57f5358001dc6b1f8993db746a3f

browser_tests on Linux_CFI bot are failing see: https://ci.chromium.org/buildbot/chromium.memory/Linux%20CFI/

Error message:

../../v8/src/heap/spaces-inl.h:275:10: runtime error: control flow integrity check for type 'v8::internal::PagedSpace' failed during cast to unrelated type (vtable address 0x00000145a810)
0x00000145a810: note: vtable is of type 'v8::internal::SemiSpace'
 00 00 00 00  b0 99 1b 09 00 00 00 00  e0 99 1b 09 00 00 00 00  c0 c4 1a 09 00 00 00 00  70 c5 1a 09

Comment 2 by mlippautz@chromium.org, Dec 5 2017

Cc: hpayer@chromium.org u...@chromium.org
Labels: -Pri-3 Pri-1
Status: Started (was: Assigned)

Comment 3 by mlippautz@chromium.org, Dec 5 2017

Blocking: 791043
Project Member

Comment 4 by bugdroid1@chromium.org, Dec 5 2017 

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/8fba2d4a25a062f96a62536c0ea6e29e4249afb0

commit 8fba2d4a25a062f96a62536c0ea6e29e4249afb0
Author: Michael Lippautz <mlippautz@chromium.org>
Date: Tue Dec 05 17:33:18 2017

[heap] Avoid checking whether FreeListCategories are linked in NewSpace

The space does not have a FreeList and the cast to PagedSpace is UB.

Bug:  chromium:792105 
Change-Id: If566374ab87374302a209a9ba4a15ce7c198a4e0
Reviewed-on: https://chromium-review.googlesource.com/809145
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49878}
[modify] https://crrev.com/8fba2d4a25a062f96a62536c0ea6e29e4249afb0/src/heap/sweeper.cc

Comment 5 by mlippautz@chromium.org, Dec 5 2017

Status: Fixed (was: Started)
►

Sign in to add a comment