DCHECK failure in __isolate__->has_pending_exception() in runtime-bigint.cc |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5103001690439680 Fuzzer: mbarbella_js_mutation Job Type: linux_asan_d8_dbg Platform Id: linux Crash Type: DCHECK failure Crash Address: Crash State: __isolate__->has_pending_exception() in runtime-bigint.cc v8::internal::__RT_impl_Runtime_BigIntBinaryOp v8::internal::Runtime_BigIntBinaryOp Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=51672:51673 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5103001690439680 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Mar 6 2018
Turns out https://chromium-review.googlesource.com/c/v8/v8/+/941130 was incorrect. Fix: https://chromium-review.googlesource.com/#/c/v8/v8/+/950472 No security impact (feature still behind flag).
,
Mar 6 2018
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/66f21389a74223b6a6372919f5c060faecad0fd8 commit 66f21389a74223b6a6372919f5c060faecad0fd8 Author: Jakob Kummerow <jkummerow@chromium.org> Date: Tue Mar 06 18:58:32 2018 [bigint] Fix Exponentiate for 1 ** multi_digit Bug: chromium:819026 Change-Id: I2c58d5e2892f683747966e00aa047153085ac121 Reviewed-on: https://chromium-review.googlesource.com/950472 Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#51776} [modify] https://crrev.com/66f21389a74223b6a6372919f5c060faecad0fd8/src/objects/bigint.cc [modify] https://crrev.com/66f21389a74223b6a6372919f5c060faecad0fd8/test/mjsunit/harmony/bigint/exp.js
,
Mar 6 2018
,
Mar 7 2018
ClusterFuzz has detected this issue as fixed in range 51775:51776. Detailed report: https://clusterfuzz.com/testcase?key=5103001690439680 Fuzzer: mbarbella_js_mutation Job Type: linux_asan_d8_dbg Platform Id: linux Crash Type: DCHECK failure Crash Address: Crash State: __isolate__->has_pending_exception() in runtime-bigint.cc v8::internal::__RT_impl_Runtime_BigIntBinaryOp v8::internal::Runtime_BigIntBinaryOp Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=51672:51673 Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=51775:51776 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5103001690439680 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Mar 7 2018
ClusterFuzz testcase 5103001690439680 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by ClusterFuzz
, Mar 6 2018Owner: jkummerow@chromium.org
Status: Assigned (was: Untriaged)