--harmony-tailcalls is broken at least since beginning of April.

 Issue 725779  has been merged into this issue.

Bisects to de04df74129bba5539c6b887a2d2c81015fff866.

ClusterFuzz testcase 5966857692774400 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

 Issue 724823  has been merged into this issue.

ClusterFuzz has detected this issue as fixed in range 46230:46231.

Detailed report: https://clusterfuzz.com/testcase?key=6344484521771008

Fuzzer: inferno_js_fuzzer
Job Type: linux_asan_d8
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000078
Crash State:
  v8::internal::compiler::FrameStateDescriptor::outer_state
  v8::internal::compiler::InstructionSelector::AddInputsToFrameStateDescriptor
  v8::internal::compiler::InstructionSelector::InitializeCallBuffer
  
Sanitizer: address (ASAN)

Regressed: V8: 45141:45142
Fixed: V8: 46230:46231

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6344484521771008


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/1769f892cef0822e6a8b5334e2ad909a0c33e906

commit 1769f892cef0822e6a8b5334e2ad909a0c33e906
Author: Adam Klein <adamk@chromium.org>
Date: Thu Jul 13 19:29:05 2017

[cleanup] Remove always-off support for tail calls

The tail call implementation is hidden behind the --harmony-tailcalls
flag, which is off-by-default (and has been unstaged since February).
It is known to be broken in a variety of cases, including clusterfuzz
security issues (see sample Chromium issues below). To avoid letting
the implementation bitrot further on trunk, this patch removes it.

Bug: v8:4698,  chromium:636914 ,  chromium:724746 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng;master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I9cb547101456a582374fdf7b1a3f044a9ef33e5c
Reviewed-on: https://chromium-review.googlesource.com/569069
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46651}
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/api.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/assembler.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/assembler.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/ast/ast.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/ast/ast.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/ast/prettyprinter.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/bootstrapper.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/builtins/arm/builtins-arm.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/builtins/arm64/builtins-arm64.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/builtins/builtins-call-gen.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/builtins/builtins-call.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/builtins/builtins-definitions.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/builtins/builtins-interpreter-gen.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/builtins/builtins-interpreter.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/builtins/builtins.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/builtins/ia32/builtins-ia32.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/builtins/mips/builtins-mips.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/builtins/mips64/builtins-mips64.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/builtins/x64/builtins-x64.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/code-factory.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/code-factory.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/code-stubs.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/code-stubs.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/compiler/ast-graph-builder.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/compiler/bytecode-graph-builder.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/compiler/bytecode-graph-builder.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/compiler/code-generator.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/compiler/frame-states.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/compiler/frame-states.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/compiler/instruction-selector.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/compiler/js-call-reducer.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/compiler/js-generic-lowering.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/compiler/js-inlining.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/compiler/js-inlining.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/compiler/js-operator.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/compiler/js-operator.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/compiler/js-typed-lowering.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/debug/debug.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/debug/debug.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/deoptimizer.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/deoptimizer.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/external-reference-table.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/flag-definitions.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/full-codegen/arm/full-codegen-arm.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/full-codegen/arm64/full-codegen-arm64.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/full-codegen/full-codegen.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/full-codegen/full-codegen.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/full-codegen/ia32/full-codegen-ia32.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/full-codegen/mips/full-codegen-mips.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/full-codegen/mips64/full-codegen-mips64.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/full-codegen/x64/full-codegen-x64.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/globals.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/interpreter/bytecode-array-builder.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/interpreter/bytecode-generator.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/interpreter/bytecodes.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/interpreter/interpreter-assembler.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/interpreter/interpreter-assembler.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/interpreter/interpreter-generator.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/interpreter/interpreter-intrinsics-generator.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/isolate.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/isolate.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/objects.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/parsing/parse-info.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/parsing/parse-info.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/parsing/parser-base.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/parsing/parser.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/parsing/parser.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/runtime/runtime-test.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/src/runtime/runtime.h
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/test/cctest/interpreter/test-interpreter.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/test/cctest/test-debug.cc
[delete] https://crrev.com/415fd8d8d1060502ad52c095aa18cd05f75d3af5/test/debugger/debug/es6/debug-stepin-tailcalls.js
[delete] https://crrev.com/415fd8d8d1060502ad52c095aa18cd05f75d3af5/test/debugger/debug/es6/debug-stepout-tailcalls.js
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/test/mjsunit/compiler/deopt-accessors5.js
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/test/mjsunit/compiler/deopt-accessors6.js
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/test/mjsunit/compiler/regress-628773.js
[delete] https://crrev.com/415fd8d8d1060502ad52c095aa18cd05f75d3af5/test/mjsunit/es6/tail-call-megatest-shard0.js
[delete] https://crrev.com/415fd8d8d1060502ad52c095aa18cd05f75d3af5/test/mjsunit/es6/tail-call-megatest-shard1.js
[delete] https://crrev.com/415fd8d8d1060502ad52c095aa18cd05f75d3af5/test/mjsunit/es6/tail-call-megatest-shard2.js
[delete] https://crrev.com/415fd8d8d1060502ad52c095aa18cd05f75d3af5/test/mjsunit/es6/tail-call-megatest-shard3.js
[delete] https://crrev.com/415fd8d8d1060502ad52c095aa18cd05f75d3af5/test/mjsunit/es6/tail-call-megatest-shard4.js
[delete] https://crrev.com/415fd8d8d1060502ad52c095aa18cd05f75d3af5/test/mjsunit/es6/tail-call-megatest-shard5.js
[delete] https://crrev.com/415fd8d8d1060502ad52c095aa18cd05f75d3af5/test/mjsunit/es6/tail-call-megatest-shard6.js
[delete] https://crrev.com/415fd8d8d1060502ad52c095aa18cd05f75d3af5/test/mjsunit/es6/tail-call-megatest-shard7.js
[delete] https://crrev.com/415fd8d8d1060502ad52c095aa18cd05f75d3af5/test/mjsunit/es6/tail-call-megatest-shard8.js
[delete] https://crrev.com/415fd8d8d1060502ad52c095aa18cd05f75d3af5/test/mjsunit/es6/tail-call-megatest-shard9.js
[delete] https://crrev.com/415fd8d8d1060502ad52c095aa18cd05f75d3af5/test/mjsunit/es6/tail-call-megatest.js
[delete] https://crrev.com/415fd8d8d1060502ad52c095aa18cd05f75d3af5/test/mjsunit/es6/tail-call-proxies.js
[delete] https://crrev.com/415fd8d8d1060502ad52c095aa18cd05f75d3af5/test/mjsunit/es6/tail-call-simple.js
[delete] https://crrev.com/415fd8d8d1060502ad52c095aa18cd05f75d3af5/test/mjsunit/es6/tail-call.js
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/test/mjsunit/mjsunit.status
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/test/mjsunit/regress/regress-593299.js
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/test/mjsunit/regress/regress-crbug-537444.js
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/test/mjsunit/regress/regress-crbug-593697-2.js
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/test/mjsunit/regress/regress-crbug-595615.js
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/test/mjsunit/regress/regress-crbug-598998.js
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/test/mjsunit/regress/regress-crbug-601617.js
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/test/mjsunit/regress/regress-crbug-604680.js
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/test/mjsunit/regress/regress-crbug-608278.js
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/test/mjsunit/regress/regress-crbug-648539.js
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/test/mjsunit/regress/regress-crbug-658691.js
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/test/mjsunit/regress/regress-crbug-685634.js
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/test/test262/test262.status
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/test/unittests/interpreter/bytecode-array-builder-unittest.cc
[modify] https://crrev.com/1769f892cef0822e6a8b5334e2ad909a0c33e906/test/unittests/interpreter/interpreter-assembler-unittest.cc

We have made a bunch of changes on ClusterFuzz side, so resetting ClusterFuzz-Wrong label.