The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/5d66a7f76b8e0bb1677381a5d77da276513d0993

commit 5d66a7f76b8e0bb1677381a5d77da276513d0993
Author: ishell <ishell@chromium.org>
Date: Fri Jul 15 13:17:43 2016

[fullcode] Restore context after calling ToNumber builtin.

BUG= chromium:628573 

Review-Url: https://codereview.chromium.org/2153783002
Cr-Commit-Position: refs/heads/master@{#37796}

[modify] https://crrev.com/5d66a7f76b8e0bb1677381a5d77da276513d0993/src/full-codegen/arm/full-codegen-arm.cc
[modify] https://crrev.com/5d66a7f76b8e0bb1677381a5d77da276513d0993/src/full-codegen/arm64/full-codegen-arm64.cc
[modify] https://crrev.com/5d66a7f76b8e0bb1677381a5d77da276513d0993/src/full-codegen/ia32/full-codegen-ia32.cc
[modify] https://crrev.com/5d66a7f76b8e0bb1677381a5d77da276513d0993/src/full-codegen/mips/full-codegen-mips.cc
[modify] https://crrev.com/5d66a7f76b8e0bb1677381a5d77da276513d0993/src/full-codegen/mips64/full-codegen-mips64.cc
[modify] https://crrev.com/5d66a7f76b8e0bb1677381a5d77da276513d0993/src/full-codegen/ppc/full-codegen-ppc.cc
[modify] https://crrev.com/5d66a7f76b8e0bb1677381a5d77da276513d0993/src/full-codegen/s390/full-codegen-s390.cc
[modify] https://crrev.com/5d66a7f76b8e0bb1677381a5d77da276513d0993/src/full-codegen/x64/full-codegen-x64.cc
[modify] https://crrev.com/5d66a7f76b8e0bb1677381a5d77da276513d0993/src/full-codegen/x87/full-codegen-x87.cc
[add] https://crrev.com/5d66a7f76b8e0bb1677381a5d77da276513d0993/test/mjsunit/regress/regress-crbug-628573.js

ClusterFuzz has detected this issue as fixed in range 37795:37796.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5288983643029504

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000007
Crash State:
  v8::internal::Context::native_context
  v8::internal::Context::global_object
  v8::internal::__RT_impl_Runtime_LoadGlobalIC_Miss
  
Regressed: V8: r37785:37786
Fixed: V8: r37795:37796

Minimized Testcase (6.41 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96yzl2WXvlr82OTtG5q0pRrbLXsuLILfVste8DUZkBjnkAc6ceZyEuJiV8HCELu92DVK2F0cVAxTjmQK_gJVrEmlbKG9Y6R76JdSO8D-dHx_fx0NghVMjWQTFx2w-B8UhxwD91oEo5brNWnnTZ96hbt7F2xqw?testcase_id=5288983643029504

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

 Issue 629007  has been merged into this issue.

 Issue 629046  has been merged into this issue.

 Issue 629000  has been merged into this issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot