Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/d4da17c6e386819426d7929fa0b6287a4f62f002 ([es2015] Optimize Object.is baseline and interesting cases.).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

Regression range points to d4da17c6e386819426d7929fa0b6287a4f62f002. Reduced repro is ..

function f() {
  Object.is();
}
f();
f();
%OptimizeFunctionOnNextCall(f);
f();

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/c77dfda0ac13080f8b8987930277b20d158acd45

commit c77dfda0ac13080f8b8987930277b20d158acd45
Author: Benedikt Meurer <bmeurer@chromium.org>
Date: Fri Oct 06 07:56:31 2017

[turbofan] Properly check call arity for Object.is(o,o).

Bug:  chromium:771971 ,  v8:6882 
Change-Id: Id1a602306bc89a5f96e180f70d6f713015d2dbb6
Reviewed-on: https://chromium-review.googlesource.com/702834
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48329}
[modify] https://crrev.com/c77dfda0ac13080f8b8987930277b20d158acd45/src/compiler/js-builtin-reducer.cc
[add] https://crrev.com/c77dfda0ac13080f8b8987930277b20d158acd45/test/mjsunit/regress/regress-crbug-771971.js

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

ClusterFuzz has detected this issue as fixed in range 48328:48329.

Detailed report: https://clusterfuzz.com/testcase?key=5234588858449920

Fuzzer: ochang_js_fuzzer
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  index < GetJSCallArity() in js-builtin-reducer.cc
  v8::internal::compiler::JSCallReduction::GetJSCallInput
  left
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=48274:48275
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=48328:48329

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5234588858449920

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5234588858449920 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot