New issue
Advanced search Search tips

Issue 903527 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Nov 13
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in v8::internal::Literal::ToBooleanIsTrue

Project Member Reported by ClusterFuzz, Nov 8

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5731378458787840

Fuzzer: libFuzzer_v8_script_parser_fuzzer
Job Type: windows_libfuzzer_chrome_asan
Platform Id: windows

Crash Type: Null-dereference READ
Crash Address: 0x000000000010
Crash State:
  v8::internal::Literal::ToBooleanIsTrue
  v8::internal::Parser::BuildUnaryExpression
  v8::internal::ParserBase<class v8::internal::Parser>::ParseBinaryContinuation
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_libfuzzer_chrome_asan&range=606269:606315

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5731378458787840

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing_on_windows.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 8

Components: Blink>JavaScript>Language Blink>JavaScript>Parser
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Nov 8

Cc: verwa...@chromium.org
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

[parser] Introduce FailureExpression to return instead of nullptr by verwaest@chromium.org - https://chromium.googlesource.com/v8/v8/+/9d27ec3aacf76b8131c323dd57968209e6f6ff4c

[parser] Reduce reliance on has_error() by verwaest@chromium.org - https://chromium.googlesource.com/v8/v8/+/1d0385cdd8d2708d8e8f2332820fe10e748d17ee

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Cc: -verwa...@chromium.org
Owner: verwa...@chromium.org
Status: Assigned (was: Untriaged)
Bisects to the following change. Might very well be a dupe of a known issue, feel free to close this if it is already known.

commit 9d27ec3aacf76b8131c323dd57968209e6f6ff4c (HEAD)
Author: Toon Verwaest <verwaest@chromium.org>
Date:   Wed Nov 7 16:38:15 2018 +0100

    [parser] Introduce FailureExpression to return instead of nullptr
    
    That allows us to keep on running further without explicit RETURN_IF
    
    Bug: v8:8363,  v8:7926 
    Change-Id: If1424a1dae656ac725a8443b09ea1b8cc25dfcb1
    Reviewed-on: https://chromium-review.googlesource.com/c/1322953
    Reviewed-by: Igor Sheludko <ishell@chromium.org>
    Commit-Queue: Toon Verwaest <verwaest@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#57319}
Cc: verwa...@chromium.org ishell@chromium.org metzman@chromium.org
 Issue 903854  has been merged into this issue.
Project Member

Comment 5 by bugdroid1@chromium.org, Nov 12

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/65ab5bb669e6b3a93175dfafce3a30f99c96e28e

commit 65ab5bb669e6b3a93175dfafce3a30f99c96e28e
Author: Toon Verwaest <verwaest@chromium.org>
Date: Mon Nov 12 09:34:22 2018

[parser] Cook invalid template literals if we've thrown

Otherwise we may look into the invalid string literal later.

Bug:  chromium:903527 
Change-Id: Ieeb3807bd05e532224e04a59878f5dac24e19579
Reviewed-on: https://chromium-review.googlesource.com/c/1329691
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57423}
[modify] https://crrev.com/65ab5bb669e6b3a93175dfafce3a30f99c96e28e/src/ast/ast.h
[modify] https://crrev.com/65ab5bb669e6b3a93175dfafce3a30f99c96e28e/src/parsing/parser-base.h
[add] https://crrev.com/65ab5bb669e6b3a93175dfafce3a30f99c96e28e/test/mjsunit/regress/regress-903527.js

Status: Fixed (was: Assigned)
Project Member

Comment 7 by ClusterFuzz, Nov 13

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 5413811865255936 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 8 by ClusterFuzz, Nov 13

ClusterFuzz has detected this issue as fixed in range 607216:607225.

Detailed report: https://clusterfuzz.com/testcase?key=5731378458787840

Fuzzer: libFuzzer_v8_script_parser_fuzzer
Job Type: windows_libfuzzer_chrome_asan
Platform Id: windows

Crash Type: Null-dereference READ
Crash Address: 0x000000000010
Crash State:
  v8::internal::Literal::ToBooleanIsTrue
  v8::internal::Parser::BuildUnaryExpression
  v8::internal::ParserBase<class v8::internal::Parser>::ParseBinaryContinuation
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_libfuzzer_chrome_asan&range=606269:606315
Fixed: https://clusterfuzz.com/revisions?job=windows_libfuzzer_chrome_asan&range=607216:607225

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5731378458787840

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing_on_windows.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
The documentation for reproducing bugs on Windows was moved to: https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md

Sign in to add a comment