PTAL

ClusterFuzz has detected this issue as fixed in range 45316:45317.

Detailed report: https://clusterfuzz.com/testcase?key=6223285387001856

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition:x64,ignition_turbo_opt
  sources: 518
  
Sanitizer: address (ASAN)

Regressed: V8: 43718:43719
Fixed: V8: 45316:45317

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6223285387001856


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Wait... How did the suppression of ".caller" fix this?

a bug :(

Is this a duplicate of 701287 then? 701287 is fixed, but this one is not...

Indeed. This case still repros. Keeping it available then.

Possibly duplicate of  issue 720320 .

 Issue 732009  has been merged into this issue.

This is due to missing deoptimization information when we use TurboFan to optimize asm.js code. We won't fix this for TurboFan. Unfortunately the asm.js-to-WebAssembly translator suffers a similar problem. I'll grab this and see if we can eventually fix this with the validator, definietely not a blocker of any kind though. The following is the stack-trace of normal execution versus asm.js validation.

======

$ ./out/x64.debug/d8 test/mjsunit/foo.js
v8-foozzie source: /v8/test/mjsunit/asm/math-fround.js
test/mjsunit/foo.js:61: TypeError: Cannot convert object to primitive value
    a = +a;
        ^
TypeError: Cannot convert object to primitive value
    at __f_3 (test/mjsunit/foo.js:61:9)
    at test/mjsunit/foo.js:66:1

======

$ ./out/x64.debug/d8 test/mjsunit/foo.js --validate-asm
v8-foozzie source: /v8/test/mjsunit/asm/math-fround.js
test/mjsunit/foo.js:66: TypeError: Cannot convert object to primitive value
__f_3(function() {});
^
TypeError: Cannot convert object to primitive value
    at test/mjsunit/foo.js:66:1

======

 Issue 708144  has been merged into this issue.