Seems to be related to "[interpreter] Bytecode register optimizer." (https://codereview.chromium.org/1997653002).

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6391885841301504

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  v8::internal::interpreter::BytecodeRegisterOptimizer::OutputRegisterTransfer
  v8::internal::interpreter::BytecodeRegisterOptimizer::PrepareRegisterOperands
  v8::internal::interpreter::BytecodeRegisterOptimizer::Write
  
Regressed: V8: r36550:36551

Minimized Testcase (14.20 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97QJPBIsdsKhrLCt9BC2HzC2uHaFt7iuDRyKNh0Uu1se9CCpDBhls4_wNX7kneiwwvEFX5FH0q8OBRgBklbfK7rPtHXipRZ4TTjf0GT4DAoxdH8IKQIFRqty00LM0CJEN2-OhPKBICj3YEGIGDXKPul2ai1Jw

Filer: ishell

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6676867390373888

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  v8::internal::interpreter::BytecodeRegisterOptimizer::OutputRegisterTransfer
  v8::internal::interpreter::BytecodeRegisterOptimizer::PrepareAccumulator
  v8::internal::interpreter::BytecodeRegisterOptimizer::Write
  
Regressed: V8: r36550:36551

Minimized Testcase (10.30 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94voZ6NBBQj7WAsZk3jTfHhUCTAqTPMCivfrds49SbiMpNlqQcHlrV0nQAyvgzixcJkT_ZJ9FbX8pxhNYRpr4ZYheQEmxXcleAlttRPpUzTrZe6SzUO2Yik-IioebgxJAMwgonSixTtPH1pE-1RfAuE90OGnw

Filer: ishell

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

ClusterFuzz has detected this issue as fixed in range 36659:36660.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6391885841301504

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  v8::internal::interpreter::BytecodeRegisterOptimizer::OutputRegisterTransfer
  v8::internal::interpreter::BytecodeRegisterOptimizer::PrepareRegisterOperands
  v8::internal::interpreter::BytecodeRegisterOptimizer::Write
  
Regressed: V8: r36550:36551
Fixed: V8: r36659:36660

Minimized Testcase (14.20 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97QJPBIsdsKhrLCt9BC2HzC2uHaFt7iuDRyKNh0Uu1se9CCpDBhls4_wNX7kneiwwvEFX5FH0q8OBRgBklbfK7rPtHXipRZ4TTjf0GT4DAoxdH8IKQIFRqty00LM0CJEN2-OhPKBICj3YEGIGDXKPul2ai1Jw

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 36659:36660.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6676867390373888

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  v8::internal::interpreter::BytecodeRegisterOptimizer::OutputRegisterTransfer
  v8::internal::interpreter::BytecodeRegisterOptimizer::PrepareAccumulator
  v8::internal::interpreter::BytecodeRegisterOptimizer::Write
  
Regressed: V8: r36550:36551
Fixed: V8: r36659:36660

Minimized Testcase (10.30 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94voZ6NBBQj7WAsZk3jTfHhUCTAqTPMCivfrds49SbiMpNlqQcHlrV0nQAyvgzixcJkT_ZJ9FbX8pxhNYRpr4ZYheQEmxXcleAlttRPpUzTrZe6SzUO2Yik-IioebgxJAMwgonSixTtPH1pE-1RfAuE90OGnw

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 36659:36660.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5775165917233152

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  v8::internal::interpreter::BytecodeRegisterOptimizer::OutputRegisterTransfer
  v8::internal::interpreter::BytecodeRegisterOptimizer::GetMaterializedEquivalentN
  v8::internal::interpreter::BytecodeRegisterOptimizer::PrepareRegisterInputOperan
  
Regressed: V8: r36550:36551
Fixed: V8: r36659:36660

Minimized Testcase (8.04 Kb): https://cluster-fuzz.appspot.com/download/AMIfv966amKGjlenyfd1VYH-mpX-a1g4PP_zyFCkHDHoftgs9pF5dYYN_5fh-7A6G8nlXwoDk4Pb-ev09fPxEQuMvKnzLv5SFJngXPTzZfSk_VAO1bP19RH3MV_pz4thBo_b17cahX46fjjsyXn80VpGxaMIl7yYzg

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot