The generators don't play nice with the --ignition-filter flag. Note that in this example we have --ignition-filter=f but the generator is called "g". I guess that is something we just have to live with. Georg, WDYT?

Georg mentioned offline that the implementation should be flexible enough to handle this. He agreed to look into it. Thanks!

Reproduces as follows ...

$ ./out/x64.debug/d8 --ignition --ignition-generators --ignition-filter=f ~/Downloads/fuzz-00291.js
$ cat ~/Downloads/fuzz-00291.js
  function* g() { yield 1; }
  var __v_1 = g();

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/54b405ce656873c894b702cbad95f5d374a94428

commit 54b405ce656873c894b702cbad95f5d374a94428
Author: neis <neis@chromium.org>
Date: Thu Jun 09 14:18:27 2016

[generators] Make runtime functions more robust.

Only look at the --ignition-generators flag when determining whether to use
Ignition (in compiler.cc).  In generator runtime functions, instead of looking
at the flag, determine the generator kind based on whether the generator has a
bytecode array.  This allows compiling some generator function using
full-codegen and others using Ignition, e.g when using --ignition-filter.

R=mstarzinger@chromium.org
BUG= chromium:618657 , v8:4907 

Review-Url: https://codereview.chromium.org/2052873002
Cr-Commit-Position: refs/heads/master@{#36864}

[modify] https://crrev.com/54b405ce656873c894b702cbad95f5d374a94428/src/runtime/runtime-generator.cc
[add] https://crrev.com/54b405ce656873c894b702cbad95f5d374a94428/test/mjsunit/regress/regress-618657.js

ClusterFuzz has detected this issue as fixed in range 36863:36864.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4517646326562816

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  HasBytecodeArray() in objects-inl.h
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_d8_ignition_dbg&range=35871:35872
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_d8_ignition_dbg&range=36863:36864

Minimized Testcase (0.05 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97N1eZhTLK2xi4aMtohee3LrbnAnz16stxct7p5_nXZhsJ3Iw3MszkuNqOJ9w_RbSgaTd_d1KI9i713DTVI_iduy3EXo1BKLLWJHlKoK_B7YflTea5OnNhd7nHGpbb-vDGJbtFab39x2l6WB_wdQxkOW6A9MA
  function* g() { yield 1; }
  var __v_1 = g();


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

 Issue 619470  has been merged into this issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot