Regression from https://chromium.googlesource.com/v8/v8/+/1cc93be0f1abf83c257b4f9ef2a215cca364f668

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Assigning ulan@ because ishell@ is on vacation.

Re-assinging to the current clussterfuzz sheriff.

Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.

Failing commit reverted by b455ec1130f2620fe383b74b4cb58d16b8bfc2a9

I think this is an intermittent failure not directly related to my commit 1cc93be0.

1. That commit only touches arm64 code, and this is an x64 failure.

2. I can still recreate the failure intermittently on master, using "seq 1000 | parallel -n0 out.gn/x64.fuzzreproducer/d8 clusterfuzz-testcase-5800635298742272.js >fuzz.log 2>&1", with failure rate of around 1 in 50 runs.

If you agree, I'll reland my commit.

ClusterFuzz has detected this issue as fixed in range 48275:48276.

Detailed report: https://clusterfuzz.com/testcase?key=5800635298742272

Fuzzer: inferno_js_fuzzer_c
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  isolate->context() == nullptr || isolate->context()->IsContext() in runtime-obje
  v8::internal::Runtime_GetProperty
  v8::internal::Invoke
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=48176:48177
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=48275:48276

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5800635298742272

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

The revert has fixed the issue. You may try to reland, but if it keeps breaking we have to roll back again and find the actual issue.

ClusterFuzz testcase 5800635298742272 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

To be clear, I can still reproduce this failure on x86-64 using master and no additional patches. It is an intermittent failure.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot