Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/e683f33db1ee840b7a0310cff80bb1897d532119 ([turbofan] Move String.prototype.{charAt,CharCodeAt} to call reducer).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/c5cc568ba17ab2fb8dd6529799f280327c5d92c3

commit c5cc568ba17ab2fb8dd6529799f280327c5d92c3
Author: Sigurd Schneider <sigurds@chromium.org>
Date: Thu Jan 11 09:10:57 2018

[turbofan] Fix fast-path of String.prototype.charAt/charCodeAt

The fast-path of S.p.charAt/charCodeAt wrongly truncates the index,
i.e. charAt(k + 4294967295) yields the same as charAt(k-1). This CL
fixes this behaviour, at the cost of not providing a fast-path for
charAt(1.1), i.e. if charAt/charCodeAt is called with a Number.

Bug:  chromium:800594 
Change-Id: Ic8e749380d3118f0c9469eb626e81bf72cf09fec
Reviewed-on: https://chromium-review.googlesource.com/860003
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50497}
[modify] https://crrev.com/c5cc568ba17ab2fb8dd6529799f280327c5d92c3/src/compiler/js-call-reducer.cc
[modify] https://crrev.com/c5cc568ba17ab2fb8dd6529799f280327c5d92c3/test/mjsunit/constant-folding-2.js

ClusterFuzz has detected this issue as fixed in range 50496:50497.

Detailed report: https://clusterfuzz.com/testcase?key=5900537169182720

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition:x64,ignition_turbo
  sources: 198
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=v8_foozzie&range=50341:50342
Fixed: https://clusterfuzz.com/revisions?job=v8_foozzie&range=50496:50497

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5900537169182720

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5900537169182720 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug requires manual review: We are only 7 days from stable.
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), kbleicher@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This was a mistake, does not need merging for M64.

Bug was introduced by v8 commit e683f33db1ee840b7a0310cff80bb1897d532119,
which was rolled first into 6.5.124.

Sorry for the noise.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/efc3f5ff5abe095bd86643f9493ca9a91b16ebff

commit efc3f5ff5abe095bd86643f9493ca9a91b16ebff
Author: Sigurd Schneider <sigurds@chromium.org>
Date: Mon Jan 22 14:49:42 2018

[turbofan] Refactor fast-path of String.p.charAt/charCodeAt/codePointAt

Bug:  chromium:800594 , v8:7092,  v8:7270 ,  v8:7270 
Change-Id: I30b69b51f793030c6f8a031a88d2dbb26a79d2bf
Reviewed-on: https://chromium-review.googlesource.com/859780
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50762}
[modify] https://crrev.com/efc3f5ff5abe095bd86643f9493ca9a91b16ebff/src/compiler/js-call-reducer.cc
[modify] https://crrev.com/efc3f5ff5abe095bd86643f9493ca9a91b16ebff/src/compiler/js-call-reducer.h
[modify] https://crrev.com/efc3f5ff5abe095bd86643f9493ca9a91b16ebff/test/mjsunit/constant-folding-2.js