// PTAL. x64/ia32 difference. The internal_error is a separate launcher problem. Seems to be compiler independent. Repro:

var v = {y:0};
v.__proto__ = {x:1};
v.__defineGetter__("y", function() { return 0; });
Object.defineProperty(v, 'x', {});

for (var i in v) {
  print(i);
}

// Output:
# Compared x64,ignition with ia32,ignition
#
# Flags of x64,ignition:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --es-staging --random-seed 1234 --ignition --turbo-filter=~ --hydrogen-filter=~ --validate-asm --nocrankshaft
# Flags of ia32,ignition:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --es-staging --random-seed 1234 --ignition --turbo-filter=~ --hydrogen-filter=~ --validate-asm --nocrankshaft
#
# Difference:
- x
#
### Start of configuration x64,ignition:
y
x

### End of configuration x64,ignition
#
### Start of configuration ia32,ignition:
y

### End of configuration ia32,ignition

Ouch. I'll investigate.

This is not actually architecture specific but dependent on the random seed. If I build without snapshot, I get different results between "--random-seed 1" and "--random-seed 2" (on both ia32 and x64).

The cache prepared by {Runtime_ForInPrepare} is already different and either contains the "x" entry or not depending on the random seed.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/f1f7050173195918e5e2177676ab0bd40166947d

commit f1f7050173195918e5e2177676ab0bd40166947d
Author: Michael Achenbach <machenbach@chromium.org>
Date: Fri Feb 03 15:32:20 2017

[foozzie] Don't use utf-8 encoding for console output.

BUG= chromium:673246 , chromium:688307 
NOTRY=true
R=tandrii@chromium.org
TBR=mstarzinger@chromium.org

Change-Id: I269032497cf574cf5180762e37b0fee1002a6c76
Reviewed-on: https://chromium-review.googlesource.com/437244
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Andrii Shyshkalov <tandrii@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#42931}
[modify] https://crrev.com/f1f7050173195918e5e2177676ab0bd40166947d/tools/foozzie/v8_foozzie.py

 Issue 688720  has been merged into this issue.

[key] Fix for-in with trailing shadowing keys with dict-mode receiver

BUG= 688307 

Review-Url: https://codereview.chromium.org/2686513002
Cr-Commit-Position: refs/heads/master@{#43006}
Committed: https://chromium.googlesource.com/v8/v8/+/d0bccc9c6ad5c843dd6d3dff628770f122b6cb63

ClusterFuzz has detected this issue as fixed in range 43005:43006.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6606569602285568

Fuzzer: foozzie_js_mutation
Job Type: foozzie_ignition_x64_ia32
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  suppression: internal_error
  
Sanitizer: address (ASAN)

Fixed: V8: 43005:43006

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94FSDwVpZFhLLLOFfMkA_EMWlwiBYsZhuYqEJfP1Bmh8wjBTwlMKQveeD1aVe1UTKM5VJmbEYlHapmRg8kWXFlYhmVALfanK9rQwsBV8Q4_xg5D2hSwRuz6wgYW0cL20KzmptWf0xg1yzN_KjEj6lJ2J_6u-tJ_WsG6JhTPOlmF4m8qd54EO89PTl5i7xvmysY7aku_udeK3Dmq-a_kPT8tJeImDSNC5ccRRSTC8nSF6NThtmT6LUnWQ1KItmb8lj4xWxV5NR-5y5gnPCHthMe5t7288YUA20jxUVFAKf5P0qrOZWX3eRgjIpeZxYn6rU0__s5F2k2QnA3QOqcYLZk-nhvFmBhd9PTjpxiSrGSu4PcpLgNTvko9KQbom42XAarbTT25GtPoQtNAlYbFFlFkNhU4cw?testcase_id=6606569602285568


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 43005:43006.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6606569602285568

Fuzzer: foozzie_js_mutation
Job Type: foozzie_ignition_x64_ia32
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  suppression: internal_error
  
Sanitizer: address (ASAN)

Fixed: V8: 43005:43006

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94FSDwVpZFhLLLOFfMkA_EMWlwiBYsZhuYqEJfP1Bmh8wjBTwlMKQveeD1aVe1UTKM5VJmbEYlHapmRg8kWXFlYhmVALfanK9rQwsBV8Q4_xg5D2hSwRuz6wgYW0cL20KzmptWf0xg1yzN_KjEj6lJ2J_6u-tJ_WsG6JhTPOlmF4m8qd54EO89PTl5i7xvmysY7aku_udeK3Dmq-a_kPT8tJeImDSNC5ccRRSTC8nSF6NThtmT6LUnWQ1KItmb8lj4xWxV5NR-5y5gnPCHthMe5t7288YUA20jxUVFAKf5P0qrOZWX3eRgjIpeZxYn6rU0__s5F2k2QnA3QOqcYLZk-nhvFmBhd9PTjpxiSrGSu4PcpLgNTvko9KQbom42XAarbTT25GtPoQtNAlYbFFlFkNhU4cw?testcase_id=6606569602285568


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

 Issue 689449  has been merged into this issue.

Your change meets the bar and is auto-approved for M57. Please go ahead and merge the CL to branch 2987 manually. Please contact milestone owner if you have questions.
Owners: amineer@(clank), cmasso@(bling), ketakid@(cros), govind@(desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

If possible, could you please merge your CL into M57 branch 2987 before 5 PM PT today, or latest by 4.00 PM PT, Thursday (02/09/17). thank you.

Please merge your change to M57 branch 2987 before 5:00 PM PT, Friday 02/10 (sooner the better please) so we can take it in for next week beta release. Thank you.

Merge already happened

Merged: [key] Fix for-in with trailing shadowing keys with dict-mode receiver

Revision: d0bccc9c6ad5c843dd6d3dff628770f122b6cb63

BUG= 688307 
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=hablich@chromium.org

Review-Url: https://codereview.chromium.org/2684983005 .
Cr-Commit-Position: refs/branch-heads/5.7@{#90}
Cr-Branched-From: 975e9a320b6eaf9f12280c35df98e013beb8f041-refs/heads/5.7.492@{#1}
Cr-Branched-From: 8d76f0e3465a84bbf0bceab114900fbe75844e1f-refs/heads/master@{#42426}
Committed: https://chromium.googlesource.com/v8/v8/+/4e083b1a151f77d2f474980bba648b125ef0771c

Per comment #16, this is already merged to M57.