Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5434746536722432

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_v8_mipsel_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  descriptors->GetKey(descriptor)->Equals(name) in transitions-inl.h
  
Regressed: V8: r37869:37870

Minimized Testcase (5.29 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94VHDYhUMT8ZR3n8LbZp1Yh-CeXtO8ZREmlBKEY28CkuJ-_iH4G68Fvl6QSqP4Bnn_ThIwKbk_Prja53LcE1DZ7i0XO2MdE2cSgUNFX_xwpWCjBzJ3efEJuKMuyeLDUVsx4wK1u_SQjMfegDKKtdBwBkjS3Jg?testcase_id=5434746536722432

Filer: jarin

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4757300002947072

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  target_number_of_fields >= *old_number_of_fields in objects.cc
  
Regressed: V8: r37869:37870

Minimized Testcase (6.81 Kb): https://cluster-fuzz.appspot.com/download/AMIfv962ZQWvsC-0mHmTff18ugvyjSfAixofr2BhQInNF36ntxITqzVafGZD05lvu2mXDeMFNEE8gLGJZqjr-wzZ1XuSZVecJnu6cJtisvtKkn0nsu3CpqtMXzYFyyU1Zn-pJFf4YS-UW-cvjgBlcvuL-SvZJ8BRbQ?testcase_id=4757300002947072

Filer: jarin

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5537702003081216

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  args[0]->IsJSArray() in runtime-array.cc
  
Regressed: V8: r37869:37870

Minimized Testcase (0.63 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95gYMt607dGZOgypbvOw3sCI_r5IR4ica9PB0OyAShw_vLuzK5cc3eyOi9W_chkIG0XLGcdKUi8aFu8diI9jRpui14x-vX-8nW6kESfdGSWj1XKQR--P229vu90IIVj4QfXJ9KKU54QU56IifRKDtS8ev1nEg?testcase_id=5537702003081216

Filer: jarin

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

ClusterFuzz has detected this issue as fixed in range 37880:37881.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5537702003081216

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  args[0]->IsJSArray() in runtime-array.cc
  
Regressed: V8: r37869:37870
Fixed: V8: r37880:37881

Minimized Testcase (0.63 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95gYMt607dGZOgypbvOw3sCI_r5IR4ica9PB0OyAShw_vLuzK5cc3eyOi9W_chkIG0XLGcdKUi8aFu8diI9jRpui14x-vX-8nW6kESfdGSWj1XKQR--P229vu90IIVj4QfXJ9KKU54QU56IifRKDtS8ev1nEg?testcase_id=5537702003081216

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 37880:37881.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6702450358878208

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  LookupIterator::ACCESSOR == it.state() in accessors.cc
  
Regressed: V8: r37869:37870
Fixed: V8: r37880:37881

Minimized Testcase (0.59 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95ddwOYDGN606VmKydcGE0ZJPzLvrX6WSwR8R0fE4hhy1lS9IBwq2QBmIVWw76PYvEn8nblkUcjFi36YciDmmEXptDOD9PYFZsjQxxCGFVWuHLFlxfjx7l-AIaqgg1xb8Wnw7t7hDWXOFSwqAGkvz_dVJxY5Q?testcase_id=6702450358878208

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Reverted the buggy CL [0] in [1]. Patch set [2] should fix the above crashes.

[0] https://codereview.chromium.org/2142933003/
[1] https://codereview.chromium.org/2159223004/
[2] https://codereview.chromium.org/2142933003/#ps240001

ClusterFuzz has detected this issue as fixed in range 37880:37881.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5434746536722432

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_v8_mipsel_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  descriptors->GetKey(descriptor)->Equals(name) in transitions-inl.h
  
Regressed: V8: r37869:37870
Fixed: V8: r37880:37881

Minimized Testcase (5.29 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94VHDYhUMT8ZR3n8LbZp1Yh-CeXtO8ZREmlBKEY28CkuJ-_iH4G68Fvl6QSqP4Bnn_ThIwKbk_Prja53LcE1DZ7i0XO2MdE2cSgUNFX_xwpWCjBzJ3efEJuKMuyeLDUVsx4wK1u_SQjMfegDKKtdBwBkjS3Jg?testcase_id=5434746536722432

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 37880:37881.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4757300002947072

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  target_number_of_fields >= *old_number_of_fields in objects.cc
  
Regressed: V8: r37869:37870
Fixed: V8: r37880:37881

Minimized Testcase (6.81 Kb): https://cluster-fuzz.appspot.com/download/AMIfv962ZQWvsC-0mHmTff18ugvyjSfAixofr2BhQInNF36ntxITqzVafGZD05lvu2mXDeMFNEE8gLGJZqjr-wzZ1XuSZVecJnu6cJtisvtKkn0nsu3CpqtMXzYFyyU1Zn-pJFf4YS-UW-cvjgBlcvuL-SvZJ8BRbQ?testcase_id=4757300002947072

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot