@marja: Only the line number seems to differ in the error message. Is this duplicate to one of the existing eager/lazy bugs or...

@mstarzinger: is this rather a problem with asm validator?

Re #1: Unrelated to the asm.js validator. But could be due to missing deoptimization information when using TurboFan to compile asm.js code.

This error message looks off:

v8-foozzie source: /v8/test/mjsunit/asm/int32array-outofbounds.js
/mnt/scratch0/clusterfuzz/slave-bot/inputs/fuzzer-testcases/ce5f82ea9d43a6c71c683fa152179f82fuzz-04064.js:17: TypeError: Cannot convert object to primitive value
function __f_9() {
^


This is the lazy configuration.

ClusterFuzz has detected this issue as fixed in range 45316:45317.

Detailed report: https://clusterfuzz.com/testcase?key=5482469955731456

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition_turbo_opt:x64,ignition_turbo_opt_eager
  sources: 475
  
Sanitizer: address (ASAN)

Regressed: V8: 43591:43592
Fixed: V8: 45316:45317

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5482469955731456


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 47276:47277.

Detailed report: https://clusterfuzz.com/testcase?key=5482469955731456

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition_turbo_opt:x64,ignition_turbo_opt_eager
  sources: 475
  
Sanitizer: address (ASAN)

Regressed: V8: 43591:43592
Fixed: V8: 47276:47277

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5482469955731456

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

I agree with comment #7, this is fixed as of 961a2c885d82502e7c90915883443435d27762d0, it is no longer possible to compile optimized code for asm.js with missing deoptimization information.

ClusterFuzz testcase 5482469955731456 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.