Status Update
No update yet.
Comments
cl...@appspot.gserviceaccount.com
me...@google.com
Assigning to the current v8 sheriff. Please note that the severity and FoundIn labels are provisional.
pe...@google.com
Setting milestone because of s0/s1 severity.
pe...@google.com
Setting Priority to P1 to match Severity s1. If this is incorrect, please reset the priority. The automation bot account won't make this change again.
sr...@google.com
This doesn't repro on head anymore and the crash is in leap tiering code. olivf@ fyi.
pe...@google.com
Setting milestone because of s0/s1 severity.
2r...@linchpin8.com
2r...@linchpin8.com
ol...@google.com
Hi @2rr0r403, I cannot repro the issue. Could you please provide more instructions, e.g., your gn args etc.
2r...@linchpin8.com
First of all, I think it's very likely that this issue has already been fixed. This is because fuzzer, which was working on the HEAD commit on the afternoon of 6 November KST, has consistently reported this issue, but has not detected any related issues since around the 8th, when several leap tiering-related commits were merged.
Regardless, I recognise that it is very important to ensure that this issue is fully resolved, and I would like to provide any help that is needed.
The args.gn you're referring to is below.
is_debug = false
dcheck_always_on = true
v8_static_library = true
v8_enable_verify_heap = true
cppgc_enable_verify_heap = true
v8_enable_turboshaft_csa = true
v8_enable_verify_csa = true
is_clang = true
v8_fuzzilli = true
sanitizer_coverage_flags = ‘trace-pc-guard’
is_asan = true
target_cpu = ‘x64’
v8_current_cpu = ‘x64’
v8_target_cpu = ‘x64’
symbol_level = 2
v8_enable_backtrace = true
v8_enable_maglev = true
v8_enable_sparkplug = true
v8_enable_31bit_smis_on_64bit_arch = true
optimise_for_fuzzing = true
2r...@linchpin8.com
Furthermore, since that date (around Nov 8) to the present, both Fuzzer and I are failing to reproduce based on HEAD.
2r...@linchpin8.com
My own assumption is that this was fixed somewhere in one of the four commits below, but I haven't investigated.
c3083403bbc4d99b2a1572016347ebc3bbdf4deb
cb0e7e181d13fd3304e76ea8ed9a87a7c210c392
1fd8ff8c22c8646a9955c60d46b34121199f7d19
4ee8c414aece0f4310d391fec307c7f28663e1fd
ol...@google.com
I am not able to reproduce this at any commit. Feel free to re-open if it re-appears. Thanks.
ph...@google.com
This bug has been closed for more than 14 weeks. Removing issue access restrictions.
Description
VULNERABILITY DETAILS
An attempt to set the tearing state by a function that does not have a feedback vector was detected.
This may affect the optimisation state and is currently being analysed in more detail.
VERSION
Chrome Version: V8 Main branch commit df246c4b Operating System: Ubuntu 24.04 LTS
REPRODUCTION CASE
./d8 --expose-gc --allow-natives-syntax ./poc.jsType of crash: SEGV_ACCERR
Crash State:
CREDIT INFORMATION
Reporter credit: Changheon Lee (@2rr0r4o3)