@jarin, as the reviewer of @yangguo's CL, can you please have a look?

Oops, please disregard, wrong tab. :)

Detailed report: https://clusterfuzz.com/testcase?key=4872556783075328

Fuzzer: inferno_js_fuzzer
Job Type: linux_asan_d8_v8_arm64_dbg
Platform Id: linux

Crash Type: Ill
Crash Address: 0x7f1667fcc378
Crash State:
  v8::internal::__RT_impl_Runtime_AbortJS
  v8::internal::Runtime_AbortJS
  v8::internal::Simulator::DoRuntimeCall
  
Sanitizer: address (ASAN)

Regressed: V8: 33377:33378

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4872556783075328


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Looks like the latest clang finds new issues. @ulan, can you perhaps have a look, or reassign?

Failure occurs in calls to internal %AbortJS, which is only accessible to tests and not in production. Lowering security severity.

This is a fuzzer bug, we needed for neuter AbortJS call in fuzzed testcases.

ClusterFuzz testcase 4872556783075328 is still reproducing on tip-of-tree build (trunk).

If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase.

Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot