// This only happens with console.log. Is this maybe not correcntess-fuzzer ready? Reduced repro - compare ignition vs. ignition_turbo_opt:

print = console.log;

var v1 = 0
function baz() {}
baz.global = this;
function foo(suites) {
  Object.keys(suites).forEach(suite => bar(suites[suite]));
  function bar(suite) {
    Object.keys(suite).forEach(test => suite[test]());
  }
}
var vars = [v1, baz]
for (var j = 0; j < vars.length && j < 7; j++) {
  try {
    foo(vars[j]);
    for (var x = 0; x < 60; x++) {
      print('************************************************************************');
    }
  } catch (e) {
  }
}

ClusterFuzz has detected this issue as fixed in range 46511:46512.

Detailed report: https://clusterfuzz.com/testcase?key=6746917227986944

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition:x64,ignition_turbo_opt
  sources: 7c0
  
Sanitizer: address (ASAN)

Regressed: V8: 46166:46167
Fixed: V8: 46511:46512

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6746917227986944


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6746917227986944 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Seems my configuration change has hidden this bug again. This means there was a bug in my change... it shouldn't have led to any behavioral change.

This seems to be a bug in the foozzie runner. When executing the raw commands, everything looks fine.

We have made a bunch of changes on ClusterFuzz side, so resetting ClusterFuzz-Wrong label.