ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6281171310215168

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_mipsel_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  args[0]->IsJSObject() in src/runtime/runtime-array.cc
  
Regressed: V8: r34400:34401

Minimized Testcase (0.20 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94QkEmzDCeVKElBGdpFytr-jQBI9MyMJFoNLT1eTdT_h3DMLfonx5GoHoGxs01x4Oh6c--ckE0ZLB85R4z82sUrYN9p79jiQ-z_49zWVan7jnGSudoqXt-8q1A0VTgD_SwbflawhWnkEmJpFgDnagrHCMbfig
__v_0 = new Proxy({},{}, { get() { throw "No trap should fire" }});
Object.setPrototypeOf(Object.prototype, __v_0);
function __f_0() { return arguments; }
__v_0 = __f_0(2,3);
Array.prototype.sort.apply(__v_0);


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This looks like something in the same family as chromium:591699. The runtime function %GetArrayKeys% is being called with a Proxy as a receiver, when it expects an Object. Georg, you've just been looking at this code for your fix for that bug; what do you think?

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/7ed2d00bc353c7401e4662cded2bc4de09670cb5

commit 7ed2d00bc353c7401e4662cded2bc4de09670cb5
Author: neis <neis@chromium.org>
Date: Tue Mar 29 12:34:04 2016

[runtime] Don't call GetArrayKeys on proxies.

This fixes another bug in Array.prototype.sort (when the array is not a
JSArray and there is a proxy on the prototype chain).

R=cbruni@chromium.org
BUG= chromium:596866 
LOG=n

Review URL: https://codereview.chromium.org/1842563004

Cr-Commit-Position: refs/heads/master@{#35101}

[modify] https://crrev.com/7ed2d00bc353c7401e4662cded2bc4de09670cb5/src/js/array.js
[modify] https://crrev.com/7ed2d00bc353c7401e4662cded2bc4de09670cb5/test/mjsunit/array-sort.js

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6281171310215168

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_mipsel_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  args[0]->IsJSObject() in src/runtime/runtime-array.cc
  
Regressed: V8: r34400:34401

Minimized Testcase (0.20 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94QkEmzDCeVKElBGdpFytr-jQBI9MyMJFoNLT1eTdT_h3DMLfonx5GoHoGxs01x4Oh6c--ckE0ZLB85R4z82sUrYN9p79jiQ-z_49zWVan7jnGSudoqXt-8q1A0VTgD_SwbflawhWnkEmJpFgDnagrHCMbfig
__v_0 = new Proxy({},{}, { get() { throw "No trap should fire" }});
Object.setPrototypeOf(Object.prototype, __v_0);
function __f_0() { return arguments; }
__v_0 = __f_0(2,3);
Array.prototype.sort.apply(__v_0);


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

[Automated comment] Request affecting a post-stable build (M49), manual review required.

Your change meets the bar and is auto-approved for M50 (branch: 2661)

[Automated comment] Request affecting a post-stable build (M49), manual review required.

M49 is post-stable and the bar is very high for merges. There are also currently no releases planned. Could you please elaborate on the impact of this issue? If this can wait till M50, please remove the Merge-Request-49 label.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/8620775d2352e8f6ff1c8ccba430ef57fcdb9ec1

commit 8620775d2352e8f6ff1c8ccba430ef57fcdb9ec1
Author: neis <neis@chromium.org>
Date: Thu Mar 31 07:36:32 2016

Version 5.0.71.27 (cherry-pick)

Merged 7ed2d00bc353c7401e4662cded2bc4de09670cb5

[runtime] Don't call GetArrayKeys on proxies.

BUG= chromium:596866 
LOG=N
R=hablich@chromium.org
NOTRY=true
NOPRESUBMIT=true

Review URL: https://codereview.chromium.org/1849723002

Cr-Commit-Position: refs/branch-heads/5.0@{#34}
Cr-Branched-From: ad16e6c2cbd2c6b0f2e8ff944ac245561c682ac2-refs/heads/5.0.71@{#1}
Cr-Branched-From: bd9df50d75125ee2ad37b3d92c8f50f0a8b5f030-refs/heads/master@{#34215}

[modify] https://crrev.com/8620775d2352e8f6ff1c8ccba430ef57fcdb9ec1/include/v8-version.h
[modify] https://crrev.com/8620775d2352e8f6ff1c8ccba430ef57fcdb9ec1/src/js/array.js
[modify] https://crrev.com/8620775d2352e8f6ff1c8ccba430ef57fcdb9ec1/test/mjsunit/array-sort.js

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot