enumeration_index out-of-bound
Reported by
scdengy...@gmail.com,
May 31 2018
|
||||||||||||||
Issue description
UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36
Steps to reproduce the problem:
class cls0 {
static get length(){ return 42; };
static get [1](){ return 21; };
};
Object.defineProperty(cls0, "length", {value:'1'});
What is the expected behavior?
What went wrong?
# Fatal error in ../../src/lookup.cc, line 507
# Debug check failed: enumeration_index > 0 (0 vs. 0).
template <typename Dictionary, typename Key>
void AddToDictionaryTemplate(Isolate* isolate, Handle<Dictionary> dictionary,
Key key, int key_index,
ClassBoilerplate::ValueKind value_kind,
Object* value) {
...
PropertyDetails details(kAccessor, DONT_ENUM,
PropertyCellType::kNoCell); <---missed the enum_order,make the enumeration_index out-of-bound
dictionary->DetailsAtPut(entry, details);
Did this work before? N/A
Chrome version: 66.0.3359.181 Channel: n/a
OS Version: OS X 10.13.4
Flash Version:
,
Jun 1 2018
scdengyuan: Thanks for the report! ishell: Can you please take a look or reassign? Thanks.
,
Jun 1 2018
ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://clusterfuzz.com/testcase?key=4698965111734272.
,
Jun 1 2018
Detailed report: https://clusterfuzz.com/testcase?key=4698965111734272 Job Type: linux_asan_d8_dbg Platform Id: linux Crash Type: DCHECK failure Crash Address: Crash State: enumeration_index > 0 in lookup.cc v8::internal::LookupIterator::ReconfigureDataProperty v8::internal::JSObject::DefineOwnPropertyIgnoreAttributes Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=49456:49457 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4698965111734272 See https://github.com/google/clusterfuzz-tools for more information.
,
Jun 1 2018
https://chromium.googlesource.com/v8/v8/+/cc9e77abe8497578a967259f643dcfb12e134fdb is the only CL in the regression range.
,
Jun 2 2018
,
Jun 2 2018
,
Jun 11 2018
Friendly ping. :)
,
Jun 18 2018
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/e602c90abcc60f039708d46810ea0cc660ac5bfc commit e602c90abcc60f039708d46810ea0cc660ac5bfc Author: Igor Sheludko <ishell@chromium.org> Date: Mon Jun 18 12:45:02 2018 Properly set enumeration order for accessor properties in class literals. Bug: chromium:848165 Change-Id: I1ec18bf12f53c24f388dbd529fe62e990fbc8783 Reviewed-on: https://chromium-review.googlesource.com/1104175 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#53793} [modify] https://crrev.com/e602c90abcc60f039708d46810ea0cc660ac5bfc/src/objects/literal-objects.cc [add] https://crrev.com/e602c90abcc60f039708d46810ea0cc660ac5bfc/test/mjsunit/regress/regress-crbug-848165.js
,
Jun 18 2018
Thank you for the report!
,
Jun 18 2018
This bug requires manual review: M68 has already been promoted to the beta branch, so this requires manual review Please contact the milestone owner if you have questions. Owners: cmasso@(Android), kariahda@(iOS), bhthompson@(ChromeOS), abdulsyed@(Desktop) For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jun 18 2018
,
Jun 18 2018
,
Jun 18 2018
Please verify the fix in canary.
,
Jun 18 2018
+ awhalley@ for M68 merge review after canary verification/coverage.
,
Jun 19 2018
ClusterFuzz has detected this issue as fixed in range 53792:53793. Detailed report: https://clusterfuzz.com/testcase?key=4698965111734272 Job Type: linux_asan_d8_dbg Platform Id: linux Crash Type: DCHECK failure Crash Address: Crash State: enumeration_index > 0 in lookup.cc v8::internal::LookupIterator::ReconfigureDataProperty v8::internal::JSObject::DefineOwnPropertyIgnoreAttributes Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=49456:49457 Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=53792:53793 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4698965111734272 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jun 19 2018
ClusterFuzz testcase 4698965111734272 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Jun 20 2018
Hi ishell@ - the VRP panel was wondering if you could provide some insight into what could go wrong here, we couldn't see a clear route to RCE.
,
Jun 21 2018
I'm sorry, I think there's no route to RCE, it's a correctness issue with a trivial fix.
,
Jun 25 2018
awhalley@ is a merge still needed for this?
,
Jun 26 2018
abdulsyed@ - no merge needed from a security point of view. ishell@, please re-add merge-request if the correctness issue requires a merge. Cheers!
,
Sep 24
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
||||||||||||||
►
Sign in to add a comment |
||||||||||||||
Comment 1 by ClusterFuzz
, May 31 2018