Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/d5c19aa9fc536638b4d3831ba01cf0f1a6a05bbe ([ic] Ensure that we make progress on KeyedLoadIC polymorphic name.).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

Minimized it to

function foo() {
  for (const x of Array.prototype) {}
}
Array.prototype[Symbol.iterator] = function*() {
  try { foo(); } catch (e) { }
  try { foo(); } catch (e) { }
}
for (const x of Array.prototype) {}

there's some place where we don't do proper stack overflow checks.

This doesn't seem to be related to my CL. Seems to be some edge case with the throwing logic? Michi, can you please take a look.

This is due to a missing stack check during generator resumption.

ClusterFuzz has detected this issue as fixed in range 49326:49327.

Detailed report: https://clusterfuzz.com/testcase?key=5979023183446016

Fuzzer: ochang_js_fuzzer
Job Type: linux_ubsan_vptr_d8
Platform Id: linux

Crash Type: Stack-overflow
Crash Address: 0x7ffc2cd9aff8
Crash State:
  v8::internal::ElementsAccessorBase<v8::internal::FastHoleyObjectElementsAccessor
  CollectElementIndices
  v8::internal::KeyAccumulator::CollectOwnElementIndices
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_d8&range=48783:48784
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_d8&range=49326:49327

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5979023183446016

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.