Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/bc293c246ac4cf99442a6f5d8b7c0e0ebc7c4fe7 ([Liftoff] Introduce LiftoffRegister type).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Liftoff is behind a flag, so no security implications.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/9a91669f405c7d67d1b14dd7cca75bd438008bd2

commit 9a91669f405c7d67d1b14dd7cca75bd438008bd2
Author: Clemens Hammacher <clemensh@chromium.org>
Date: Thu Dec 07 10:51:46 2017

[Liftoff] Fix cache state initialization

Ensure that the type is always stored correctly.

R=titzer@chromium.org

Bug: v8:6600,  chromium:791810 
Change-Id: Id3a3c20b14f8730b9550c548dec49ac47121e691
Reviewed-on: https://chromium-review.googlesource.com/811188
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49924}
[modify] https://crrev.com/9a91669f405c7d67d1b14dd7cca75bd438008bd2/src/wasm/baseline/liftoff-assembler.cc
[add] https://crrev.com/9a91669f405c7d67d1b14dd7cca75bd438008bd2/test/mjsunit/regress/wasm/regress-791810.js

ClusterFuzz has detected this issue as fixed in range 522434:522455.

Detailed report: https://clusterfuzz.com/testcase?key=6496346524876800

Fuzzer: libFuzzer_v8_wasm_call_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  rc == kGpReg || rc == kFpReg in liftoff-assembler.h
  has_unused_register
  v8::internal::wasm::LiftoffAssembler::CacheState::InitMerge
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=521282:521293
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=522434:522455

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6496346524876800

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6496346524876800 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.