New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 866208 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jul 24
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac , Fuchsia
Pri: 1
Type: Bug-Security



Sign in to add a comment

DCHECK failure in !Contains(string) in heap-inl.h

Project Member Reported by ClusterFuzz, Jul 21

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4841210242662400

Fuzzer: ochang_js_fuzzer
Job Type: linux_d8_dbg
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  !Contains(string) in heap-inl.h
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_d8_dbg&range=54598:54599

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4841210242662400

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jul 21

Cc: rfbpb@google.com
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Avoiding re-externalization of strings. by rfbpb@google.com - https://chromium.googlesource.com/v8/v8/+/2c4c2ad694dfd4e852039644c7bfe22e594587c6

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 2 by sheriffbot@chromium.org, Jul 21

Labels: Pri-1
Cc: jkummerow@chromium.org
Labels: Security_Impact-Head M-70 OS-Android OS-Chrome OS-Fuchsia OS-Mac OS-Windows
Owner: u...@chromium.org
Status: Assigned (was: Untriaged)
Assigning to one of the reviewers of the suspected CL as the committer is not a project memeber. Adding the other reviewer to cc as well.

This also seems likely to affect all V8 platforms, so updating OS labels.
The culprit CL has already been reverted for other reasons:
https://chromium.googlesource.com/v8/v8/+/367815ea13a088e8ba24765dc291d0649e4880d9

Rodrigo, before relanding, please make sure the fixed version addresses this issue as well.
Project Member

Comment 5 by ClusterFuzz, Jul 24

ClusterFuzz has detected this issue as fixed in range 54610:54611.

Detailed report: https://clusterfuzz.com/testcase?key=4841210242662400

Fuzzer: ochang_js_fuzzer
Job Type: linux_d8_dbg
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  !Contains(string) in heap-inl.h
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_d8_dbg&range=54598:54599
Fixed: https://clusterfuzz.com/revisions?job=linux_d8_dbg&range=54610:54611

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4841210242662400

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 6 by ClusterFuzz, Jul 24

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 4841210242662400 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 7 by bugdroid1@chromium.org, Jul 24

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/f34158c9d2abec367ec3930732fdf294cd1ca188

commit f34158c9d2abec367ec3930732fdf294cd1ca188
Author: Rodrigo Bruno <rfbpb@google.com>
Date: Tue Jul 24 11:02:59 2018

Reland "Avoiding re-externalization of strings."

This is a reland of 2c4c2ad694dfd4e852039644c7bfe22e594587c6

Original change's description:
> Avoiding re-externalization of strings.
>
> Bug: chromium:845409
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
> Change-Id: I75bddcf0e8879d2161486f24d1cd4e46d8fe008d
> Reviewed-on: https://chromium-review.googlesource.com/1139056
> Commit-Queue: Rodrigo Bruno <rfbpb@google.com>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54599}

Bug:  chromium:866208 
Change-Id: I7714bfc695ebeaf55b9ccbbc6b11368416ce7fec
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1146583
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Rodrigo Bruno <rfbpb@google.com>
Cr-Commit-Position: refs/heads/master@{#54637}
[modify] https://crrev.com/f34158c9d2abec367ec3930732fdf294cd1ca188/include/v8.h
[modify] https://crrev.com/f34158c9d2abec367ec3930732fdf294cd1ca188/src/api.cc
[modify] https://crrev.com/f34158c9d2abec367ec3930732fdf294cd1ca188/src/extensions/externalize-string-extension.cc
[modify] https://crrev.com/f34158c9d2abec367ec3930732fdf294cd1ca188/src/heap/heap-inl.h
[modify] https://crrev.com/f34158c9d2abec367ec3930732fdf294cd1ca188/src/heap/heap.cc
[modify] https://crrev.com/f34158c9d2abec367ec3930732fdf294cd1ca188/src/heap/heap.h
[modify] https://crrev.com/f34158c9d2abec367ec3930732fdf294cd1ca188/src/objects.cc
[modify] https://crrev.com/f34158c9d2abec367ec3930732fdf294cd1ca188/src/objects/string.h

Project Member

Comment 8 by bugdroid1@chromium.org, Jul 24

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/765c1eac1f0377dc133eecf25e623b8d68b69376

commit 765c1eac1f0377dc133eecf25e623b8d68b69376
Author: Sigurd Schneider <sigurds@chromium.org>
Date: Tue Jul 24 13:37:04 2018

Speculatively Revert "Reland "Avoiding re-externalization of strings.""

This reverts commit f34158c9d2abec367ec3930732fdf294cd1ca188.

Reason for revert: Seems to trigger DCHECKS. Two CLs in range; this one seemed more likely.
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Linux%2064%20(dbg)/12787
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Linux%2064%20(dbg)/12788


Original change's description:
> Reland "Avoiding re-externalization of strings."
> 
> This is a reland of 2c4c2ad694dfd4e852039644c7bfe22e594587c6
> 
> Original change's description:
> > Avoiding re-externalization of strings.
> >
> > Bug: chromium:845409
> > Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
> > Change-Id: I75bddcf0e8879d2161486f24d1cd4e46d8fe008d
> > Reviewed-on: https://chromium-review.googlesource.com/1139056
> > Commit-Queue: Rodrigo Bruno <rfbpb@google.com>
> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#54599}
> 
> Bug:  chromium:866208 
> Change-Id: I7714bfc695ebeaf55b9ccbbc6b11368416ce7fec
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
> Reviewed-on: https://chromium-review.googlesource.com/1146583
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Rodrigo Bruno <rfbpb@google.com>
> Cr-Commit-Position: refs/heads/master@{#54637}

TBR=ulan@chromium.org,jkummerow@chromium.org,hpayer@chromium.org,mlippautz@chromium.org,rfbpb@google.com

Change-Id: Id12382d66bc5c9b5c76d73b06a6b421dd4d7be66
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  chromium:866208 
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1148400
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54645}
[modify] https://crrev.com/765c1eac1f0377dc133eecf25e623b8d68b69376/include/v8.h
[modify] https://crrev.com/765c1eac1f0377dc133eecf25e623b8d68b69376/src/api.cc
[modify] https://crrev.com/765c1eac1f0377dc133eecf25e623b8d68b69376/src/extensions/externalize-string-extension.cc
[modify] https://crrev.com/765c1eac1f0377dc133eecf25e623b8d68b69376/src/heap/heap-inl.h
[modify] https://crrev.com/765c1eac1f0377dc133eecf25e623b8d68b69376/src/heap/heap.cc
[modify] https://crrev.com/765c1eac1f0377dc133eecf25e623b8d68b69376/src/heap/heap.h
[modify] https://crrev.com/765c1eac1f0377dc133eecf25e623b8d68b69376/src/objects.cc
[modify] https://crrev.com/765c1eac1f0377dc133eecf25e623b8d68b69376/src/objects/string.h

Project Member

Comment 9 by sheriffbot@chromium.org, Jul 24

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 10 by bugdroid1@chromium.org, Jul 25

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/da9386ae2d0416ac883cd1ce343a0ca3eac43519

commit da9386ae2d0416ac883cd1ce343a0ca3eac43519
Author: Rodrigo Bruno <rfbpb@google.com>
Date: Wed Jul 25 18:54:28 2018

Reland^2 "Avoiding re-externalization of strings"

Previously landed as 2c4c2ad694dfd4e852039644c7bfe22e594587c6 / #54599 and
f34158c9d2abec367ec3930732fdf294cd1ca188 / #54637

Previously reviewed at https://chromium-review.googlesource.com/1139056 and
https://chromium-review.googlesource.com/1146583

Bug: chromium:845409,  chromium:866208 
Change-Id: Idb1b6d1b29499f66bf8cd704977c40b027f99dbd
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1148281
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Rodrigo Bruno <rfbpb@google.com>
Cr-Commit-Position: refs/heads/master@{#54703}
[modify] https://crrev.com/da9386ae2d0416ac883cd1ce343a0ca3eac43519/include/v8.h
[modify] https://crrev.com/da9386ae2d0416ac883cd1ce343a0ca3eac43519/src/api.cc
[modify] https://crrev.com/da9386ae2d0416ac883cd1ce343a0ca3eac43519/src/extensions/externalize-string-extension.cc
[modify] https://crrev.com/da9386ae2d0416ac883cd1ce343a0ca3eac43519/src/heap/heap-inl.h
[modify] https://crrev.com/da9386ae2d0416ac883cd1ce343a0ca3eac43519/src/heap/heap.cc
[modify] https://crrev.com/da9386ae2d0416ac883cd1ce343a0ca3eac43519/src/heap/heap.h
[modify] https://crrev.com/da9386ae2d0416ac883cd1ce343a0ca3eac43519/src/objects.cc
[modify] https://crrev.com/da9386ae2d0416ac883cd1ce343a0ca3eac43519/src/objects/string.h

Project Member

Comment 11 by sheriffbot@chromium.org, Oct 30

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment