Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/f0e3f8ea6f5b614259c6b5f1b87d64f31711f0bb ([ignition] Decrease code size multiplier to 24.).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Somewhat reduced repro ...

var global;
function f() {
  var local = 'abcdefghijklmnopqrst';
  local += 'abcdefghijkl' + (0 + global);
  global += 'abcdefghijkl';
}
f();
%OptimizeFunctionOnNextCall(f);
f();

Fix is in flight ...

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/93f855cc57307ca43716517b5a80f2cb2ff9d00a

commit 93f855cc57307ca43716517b5a80f2cb2ff9d00a
Author: Michael Starzinger <mstarzinger@chromium.org>
Date: Thu Oct 12 10:02:29 2017

[turbofan] Fix type of inline cons-string allocation.

This propagates the existing type of a {JSAdd} node back to the newly
created {Allocate} node. There are cases where said type is {None}.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-772720
BUG= chromium:772720 

Change-Id: Iab18d2108a789b51db4e405f7f335c5c0ca6f686
Reviewed-on: https://chromium-review.googlesource.com/708796
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48493}
[modify] https://crrev.com/93f855cc57307ca43716517b5a80f2cb2ff9d00a/src/compiler/js-typed-lowering.cc
[add] https://crrev.com/93f855cc57307ca43716517b5a80f2cb2ff9d00a/test/mjsunit/regress/regress-crbug-772720.js

ClusterFuzz has detected this issue as fixed in range 48492:48493.

Detailed report: https://clusterfuzz.com/testcase?key=6048335306948608

Fuzzer: ochang_js_fuzzer
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  NodeProperties::GetType(val)->Is(NodeProperties::GetType(node)) in verifier.cc
  v8::internal::compiler::Verifier::Visitor::Check
  v8::internal::compiler::Verifier::Run
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=44001:44002
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=48492:48493

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6048335306948608

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6048335306948608 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug requires manual review: M63 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), gkihumba@(ChromeOS), govind@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

+awhalley@, is this good to take for M63 now?

govind@ - yep

Approving merge to M63 branch 3239 based on comment #18. Please merge ASAP so we can take it in for next week Beta release. Thank you.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/58e4c540bfe663e59dc8e2586a445b6b99af149b

commit 58e4c540bfe663e59dc8e2586a445b6b99af149b
Author: Michael Starzinger <mstarzinger@google.com>
Date: Tue Nov 07 14:05:51 2017

Merged: [turbofan] Fix type of inline cons-string allocation.

Revision: 93f855cc57307ca43716517b5a80f2cb2ff9d00a

R=jarin@chromium.org
BUG= chromium:772720 
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Change-Id: Ib3e0fa95ee279cc9e58c93e1434eb0ed76daab20
Reviewed-on: https://chromium-review.googlesource.com/757095
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.3@{#55}
Cr-Branched-From: 094a7c93dcdcd921de3883ba4674b7e1a0feffbe-refs/heads/6.3.292@{#1}
Cr-Branched-From: 18b8fbb528a8021e04a029e06eafee50b918bce0-refs/heads/master@{#48432}
[modify] https://crrev.com/58e4c540bfe663e59dc8e2586a445b6b99af149b/src/compiler/js-typed-lowering.cc
[add] https://crrev.com/58e4c540bfe663e59dc8e2586a445b6b99af149b/test/mjsunit/regress/regress-crbug-772720.js

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This is already merged to M63 at comment #20.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot