New issue
Advanced search Search tips

Issue 869837 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Aug 14
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug-Security



Sign in to add a comment

Crash in v8::internal::Simulator::LoadStoreHelper

Project Member Reported by ClusterFuzz, Aug 1

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5065091050110976

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_msan_content_shell_drt
Platform Id: linux

Crash Type: UNKNOWN WRITE
Crash Address: 0x7f87c03f3ff8
Crash State:
  v8::internal::Simulator::LoadStoreHelper
  v8::internal::Simulator::ExecuteInstruction
  v8::internal::Simulator::Run
  
Sanitizer: memory (MSAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=579507:579508

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5065091050110976

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Aug 1

Components: Blink>JavaScript
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by sheriffbot@chromium.org, Aug 1

Labels: M-69 Target-69
Project Member

Comment 3 by sheriffbot@chromium.org, Aug 1

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 4 by sheriffbot@chromium.org, Aug 1

Labels: Pri-1
Project Member

Comment 5 by sheriffbot@chromium.org, Aug 2

Labels: -Security_Impact-Head Security_Impact-Beta
V8 Sheriff, please take a look and help to find an owner.

Regression range is pretty weird though: https://chromium.googlesource.com/chromium/src/+log/f60b696f611392218fb10d6643276e82305ce483..2a1bc9781a5782c5d5155289f779a5c6585787e5?pretty=fuller&n=10000
Owner: titzer@chromium.org
Status: Assigned (was: Untriaged)
M69 Stable promotion is coming VERY soon. Your bug is labelled as Stable ReleaseBlock, pls make sure to land the fix and request a merge into the release branch ASAP. Thank you.
Status: Started (was: Assigned)
Suspecting stack overflow after running the testcase in a normal debug d8. Running MSAN now...
I've been able to reproduce this on Arm64Debug and Arm64Release from two weeks ago. Will bisect, but I bet this is one of a number of long-standing stack overflow bugs that probably does not merit a stable blocker.
Labels: -Pri-1 -ReleaseBlock-Stable Pri-2
Confirmed that this crashes as far back as May 2018. Remove stable blocker and lowering priority.
Project Member

Comment 12 by ClusterFuzz, Aug 14

ClusterFuzz has detected this issue as fixed in range 582653:582655.

Detailed report: https://clusterfuzz.com/testcase?key=5065091050110976

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_msan_content_shell_drt
Platform Id: linux

Crash Type: UNKNOWN WRITE
Crash Address: 0x7f87c03f3ff8
Crash State:
  v8::internal::Simulator::LoadStoreHelper
  v8::internal::Simulator::ExecuteInstruction
  v8::internal::Simulator::Run
  
Sanitizer: memory (MSAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=579507:579508
Fixed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=582653:582655

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5065091050110976

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 13 by ClusterFuzz, Aug 14

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 5065091050110976 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 14 by sheriffbot@chromium.org, Aug 14

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 15 by sheriffbot@chromium.org, Sep 14

Labels: Merge-Request-70
Project Member

Comment 16 by sheriffbot@chromium.org, Sep 14

Labels: -Merge-Request-70 Merge-Review-70 Hotlist-Merge-Review
This bug requires manual review: M70 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: benmason@(Android), kariahda@(iOS), geohsu@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: -Merge-Review-70
Project Member

Comment 18 by sheriffbot@chromium.org, Nov 20

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment