Issue metadata
Sign in to add a comment
|
V8 correctness failure in configs: x64,ignition_turbo_opt:x64,ignition_turbo_opt_eager |
||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5715000907005952 Fuzzer: foozzie_js_mutation Job Type: v8_foozzie Platform Id: linux Crash Type: V8 correctness failure Crash Address: Crash State: configs: x64,ignition_turbo_opt:x64,ignition_turbo_opt_eager sources: 590 Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=v8_foozzie&range=47802:47803 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5715000907005952 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Jan 8 2018
The repro is:
function ToInteger() {
if((x === +0)
|| (x === Number.NEGATIVE_INFINITY)){
}
}
var __v_13 = undefined;
var __v_15 = {};
print("v8-foozzie source: /test262/language/expressions/class/dstr-meth-static-ary-ptrn-elem-ary-empty-init.js");
__v_6 = class {
static method([[] = function() { __v_15 += 1; return __v_13; }()]) {
}
};
__v_6.method([]);
... isn't this a duplicate of something...? I don't remember.
,
Jan 8 2018
|
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by ClusterFuzz
, Dec 7 2017Owner: marja@chromium.org
Status: Assigned (was: Untriaged)