Hey Franzi,

your CL 947a0437668ce21392358634494543a664c6b123 introduced the crash with the following error message:

#
# Fatal error in ../../src/runtime/runtime-object.cc, line 697
# Check failed: args[0]->IsString().
#

Your CL de04df74129bba5539c6b887a2d2c81015fff866 turned the error into

#
# Fatal error in ../../src/compiler/instruction-selector.cc, line 570
# Check failed: IrOpcode::kFrameState == state->op()->opcode() (FrameState vs. 0).
#

Can you take a look please?

Detailed report: https://clusterfuzz.com/testcase?key=6078621684072448

Fuzzer: inferno_js_fuzzer
Job Type: linux_asan_d8_v8_arm64_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  IrOpcode::kFrameState == state->op()->opcode() in instruction-selector.cc
  v8::internal::compiler::InstructionSelector::AddInputsToFrameStateDescriptor
  v8::internal::compiler::InstructionSelector::InitializeCallBuffer
  
Sanitizer: address (ASAN)

Regressed: V8: 43955:43956

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6078621684072448


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Applying security view restrictions to all v8 CHECK/DCHECK failures.

(CHECKs aren't security, but we have no way to distinguish these right now).

Detailed report: https://clusterfuzz.com/testcase?key=4738652604465152

Fuzzer: inferno_js_fuzzer
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  IrOpcode::kFrameState == state->op()->opcode() in instruction-selector.cc
  v8::internal::compiler::InstructionSelector::AddInputsToFrameStateDescriptor
  v8::internal::compiler::InstructionSelector::InitializeCallBuffer
  
Sanitizer: address (ASAN)

Regressed: V8: 43955:43956

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4738652604465152


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Detailed report: https://clusterfuzz.com/testcase?key=4738652604465152

Fuzzer: inferno_js_fuzzer
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  IrOpcode::kFrameState == state->op()->opcode() in instruction-selector.cc
  v8::internal::compiler::InstructionSelector::AddInputsToFrameStateDescriptor
  v8::internal::compiler::InstructionSelector::InitializeCallBuffer
  
Sanitizer: address (ASAN)

Regressed: V8: 43955:43956

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4738652604465152


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

franzih: Uh oh! This issue still open and hasn't been updated in the last 20 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

+ Andrew - can you please review for M59?

This is behind an experimental flag, --type-profile. Shouldn't be an issue because nobody should use it.

Restoring severity label but marking as no-impact.

ClusterFuzz has detected this issue as fixed in range 46230:46231.

Detailed report: https://clusterfuzz.com/testcase?key=5341429806399488

Fuzzer: inferno_js_fuzzer
Job Type: linux_asan_d8_v8_arm64_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  IrOpcode::kFrameState == state->op()->opcode() in instruction-selector.cc
  
Sanitizer: address (ASAN)

Regressed: V8: 44636:44637
Fixed: V8: 46230:46231

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5341429806399488


Additional requirements: Requires Gestures

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 46650:46651.

Detailed report: https://clusterfuzz.com/testcase?key=4738652604465152

Fuzzer: inferno_js_fuzzer
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  IrOpcode::kFrameState == state->op()->opcode() in instruction-selector.cc
  v8::internal::compiler::InstructionSelector::AddInputsToFrameStateDescriptor
  v8::internal::compiler::InstructionSelector::InitializeCallBuffer
  
Sanitizer: address (ASAN)

Regressed: V8: 43955:43956
Fixed: V8: 46650:46651

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4738652604465152


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 46650:46651.

Detailed report: https://clusterfuzz.com/testcase?key=6078621684072448

Fuzzer: inferno_js_fuzzer
Job Type: linux_asan_d8_v8_arm64_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  IrOpcode::kFrameState == state->op()->opcode() in instruction-selector.cc
  
Sanitizer: address (ASAN)

Regressed: V8: 43955:43956
Fixed: V8: 46650:46651

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6078621684072448


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Support for tail calls was removed. I think this is no longer an issue.

ClusterFuzz testcase 4738652604465152 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot