Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/0ac7a48ae8c6dbfd1dd4c9e6d5cd4b1a8bd72fe1 ([foozzie] Add slow-path correctness fuzzing variants).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

PTAL. Difference with promises between configurations ignition and slow_path_opt.

 Issue 800586  has been merged into this issue.

 Issue 800689  has been merged into this issue.

 Issue 800699  has been merged into this issue.

 Issue 800765  has been merged into this issue.

 Issue 800766  has been merged into this issue.

 Issue 801055  has been merged into this issue.

 Issue 800954  has been merged into this issue.

 Issue 801099  has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/5e50857e2c40f11fd6ee3e17e52b20bf3dc3e2a8

commit 5e50857e2c40f11fd6ee3e17e52b20bf3dc3e2a8
Author: Michael Achenbach <machenbach@chromium.org>
Date: Thu Jan 11 15:14:55 2018

[foozzie] Suppress test cases with async in slow-path mode

NOTRY=true
TBR=gsathya@chromium.org

Bug:  chromium:800651 
Change-Id: I72717fcd694609132b76431c13c26fb3f79432dd
Reviewed-on: https://chromium-review.googlesource.com/860926
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50509}
[modify] https://crrev.com/5e50857e2c40f11fd6ee3e17e52b20bf3dc3e2a8/tools/foozzie/v8_suppressions.py

This is interesting. The ordering of the promises is different for the slow_path_opt -- looks like this is similar to https://bugs.chromium.org/p/v8/issues/detail?id=6007

Will take a look

 Issue 801326  has been merged into this issue.

 Issue 801267  has been merged into this issue.

ClusterFuzz has detected this issue as fixed in range 50508:50509.

Detailed report: https://clusterfuzz.com/testcase?key=5159014924288000

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition:x64,slow_path_opt
  sources: 746
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=v8_foozzie&range=50381:50382
Fixed: https://clusterfuzz.com/revisions?job=v8_foozzie&range=50508:50509

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5159014924288000

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5159014924288000 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This was closed because of the suppression I added. The issue needs manual verification and the suppression should be removed once the bug is fixed.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/0f6eafe85585940fc118e1c133d939c539e88f29

commit 0f6eafe85585940fc118e1c133d939c539e88f29
Author: Sathya Gunasekaran <gsathya@chromium.org>
Date: Wed Jan 31 19:19:56 2018

[promise] Remove incorrect fast path

Previously we would directly take the result from a fulfilled native
promise bypassing the microtask queue. This is observably different
from the spec.

Note: Our variant of the bluebird benchmark is heavily favored towards
fulfilled native promises because we don't use setTimeout (unlike the
original benchmark). I suspect this pattern doesn't appear often in
the wild so it's fine to take this hit for now.

PSA for Perf sheriffs: this is going to tank some benchmarks.

Bug:  chromium:800651 ,  v8:5691 ,  v8:6007 
Change-Id: Ic273bf2195529424b0d87359d28d5267060d5252
Reviewed-on: https://chromium-review.googlesource.com/895416
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51010}
[modify] https://crrev.com/0f6eafe85585940fc118e1c133d939c539e88f29/src/builtins/builtins-promise-gen.cc
[add] https://crrev.com/0f6eafe85585940fc118e1c133d939c539e88f29/test/mjsunit/regress/regress-5691.js
[add] https://crrev.com/0f6eafe85585940fc118e1c133d939c539e88f29/test/mjsunit/regress/regress-800651.js

majeski and machenbach, thank you for working on these fuzzers! These are great :)

ClusterFuzz testcase 6183129105825792 is still reproducing on tip-of-tree build (trunk).

Please re-test your fix against this testcase and if the fix was incorrect or incomplete, please re-open the bug. Otherwise, ignore this notification and add ClusterFuzz-Wrong label.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/14108f4c2e0b4c46f12d99a8674de743dff10e17

commit 14108f4c2e0b4c46f12d99a8674de743dff10e17
Author: Benedikt Meurer <bmeurer@chromium.org>
Date: Wed Feb 07 19:46:59 2018

[builtins] Mega-revert to address the Dev blocker in crbug.com/808911.

- Revert "[builtins] Save one word in contexts for Promise.all."
  This reverts commit 7632da067b73a797482571163354175f73f50952.
- Revert "[builtins] Also use the Promise#then protector for Promise#finally()."
  This reverts commit d4f072ced3413dac8a502add6cc5b79c17bc8b4b.
- Revert "[builtins] Don't mess with entered context for MicrotaskCallbacks."
  This reverts commit 6703dacdd6e4c0e0da4085cfc46e7291ef78949c.
- Revert "[debugger] Properly deal with settled promises in catch prediction."
  This reverts commit 40dd065823a87e671fe6cb0bba7197bd28833f1d.
- Revert "[builtins] Widen the fast-path for Promise builtins."
  This reverts commit db0556b7e8a2965a27be956e5ce2e2e2d832808c.
- Revert "[builtins] Unify PerformPromiseThen and optimize it with TurboFan."
  This reverts commit a582199c5e56c9c84312dfa6d6fa6de724e1a806.
- Revert "[builtins] Remove obsolete PromiseBuiltinsAssembler::AppendPromiseCallback."
  This reverts commit 6bf888529092326c59165d369baf083ca7cc519b.
- Revert "[builtins] Turn NewPromiseCapability into a proper builtin."
  This reverts commit 313b490ddd35367f5e7fe4a7073054ecd8a732ae.
- Revert "[builtins] Inline InternalPromiseThen into it's only caller"
  This reverts commit f7bd6a2fd65e7b8ae90574d8411aeb5695c40716.
- Revert "[builtins] Implement Promise#catch by really calling into Promise#then."
  This reverts commit b23b098fa02e24c0b1551f6b6a85619194af76ed.
- Revert "[promise] Remove incorrect fast path"
  This reverts commit 0f6eafe85585940fc118e1c133d939c539e88f29.
- Revert "[builtins] Squeeze JSPromise::result and JSPromise::reactions into a single field."
  This reverts commit 8a677a28312855955d96a64caf91601d9196cc7b.
- Revert "[builtins] Refactor promises to reduce GC overhead."
  This reverts commit 8e7737cb5811dcb9bc9e125acd9d7d4e0cfcac70.

Tbr: hpayer@chromium.org
Bug:  chromium:800651 , chromium:808911,  v8:5691 , v8:7253
Change-Id: I8c8ea5ed32ed62f6cd8b0d027a3707ddd891e5f1
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/906991
Commit-Queue: Yang Guo <yangguo@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51158}
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/include/v8.h
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/api.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/bootstrapper.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/builtins/builtins-async-gen.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/builtins/builtins-async-iterator-gen.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/builtins/builtins-definitions.h
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/builtins/builtins-internal-gen.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/builtins/builtins-promise-gen.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/builtins/builtins-promise-gen.h
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/code-stub-assembler.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/code-stub-assembler.h
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/compiler/js-call-reducer.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/compiler/js-call-reducer.h
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/compiler/js-create-lowering.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/compiler/js-generic-lowering.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/compiler/js-operator.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/compiler/js-operator.h
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/compiler/opcodes.h
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/compiler/typer.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/compiler/types.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/compiler/verifier.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/contexts.h
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/factory.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/factory.h
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/heap-symbols.h
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/heap/heap.h
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/heap/setup-heap-internal.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/isolate.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/isolate.h
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/lookup.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/lookup.h
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/objects-debug.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/objects-inl.h
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/objects-printer.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/objects.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/objects.h
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/objects/map-inl.h
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/objects/map.h
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/profiler/heap-snapshot-generator.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/runtime/runtime-debug.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/src/runtime/runtime-promise.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/test/cctest/heap/test-heap.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/test/cctest/test-api.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/test/cctest/test-code-stub-assembler.cc
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/test/cctest/test-heap-profiler.cc
[delete] https://crrev.com/7f981c6c217204eab028c1db0c9287cbea17d264/test/debugger/regress/regress-crbug-808973.js
[delete] https://crrev.com/7f981c6c217204eab028c1db0c9287cbea17d264/test/mjsunit/compiler/promise-prototype-catch-custom-then-1.js
[delete] https://crrev.com/7f981c6c217204eab028c1db0c9287cbea17d264/test/mjsunit/compiler/promise-prototype-catch-custom-then-2.js
[delete] https://crrev.com/7f981c6c217204eab028c1db0c9287cbea17d264/test/mjsunit/compiler/promise-prototype-catch-subclass.js
[delete] https://crrev.com/7f981c6c217204eab028c1db0c9287cbea17d264/test/mjsunit/compiler/promise-prototype-catch.js
[delete] https://crrev.com/7f981c6c217204eab028c1db0c9287cbea17d264/test/mjsunit/compiler/promise-prototype-finally-custom-then-1.js
[delete] https://crrev.com/7f981c6c217204eab028c1db0c9287cbea17d264/test/mjsunit/compiler/promise-prototype-finally-custom-then-2.js
[delete] https://crrev.com/7f981c6c217204eab028c1db0c9287cbea17d264/test/mjsunit/compiler/promise-prototype-finally-subclass.js
[delete] https://crrev.com/7f981c6c217204eab028c1db0c9287cbea17d264/test/mjsunit/compiler/promise-prototype-finally.js
[delete] https://crrev.com/7f981c6c217204eab028c1db0c9287cbea17d264/test/mjsunit/compiler/promise-prototype-then.js
[delete] https://crrev.com/7f981c6c217204eab028c1db0c9287cbea17d264/test/mjsunit/regress/regress-5691.js
[delete] https://crrev.com/7f981c6c217204eab028c1db0c9287cbea17d264/test/mjsunit/regress/regress-800651.js
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/test/webkit/fast/js/Promise-resolve-with-then-exception-expected.txt
[modify] https://crrev.com/14108f4c2e0b4c46f12d99a8674de743dff10e17/tools/v8heapconst.py

Please revisit this, since Clusterfuzz claims it still can repro in comment 20. Is that due to the mega-revert in comment 21? Just the order doesn't seem right, but maybe bugdroid was slow with comment 21?

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/3916401e4b359ca096119f42fc22cc5a45aeb4ea

commit 3916401e4b359ca096119f42fc22cc5a45aeb4ea
Author: Adam Klein <adamk@chromium.org>
Date: Thu Feb 08 17:25:13 2018

Revert "[builtins] Mega-revert to address the Dev blocker in crbug.com/808911."

This reverts commit 14108f4c2e0b4c46f12d99a8674de743dff10e17.

Reason for revert: Not the culprit for Canary microtask crashes

Original change's description:
> [builtins] Mega-revert to address the Dev blocker in crbug.com/808911.
> 
> - Revert "[builtins] Save one word in contexts for Promise.all."
>   This reverts commit 7632da067b73a797482571163354175f73f50952.
> - Revert "[builtins] Also use the Promise#then protector for Promise#finally()."
>   This reverts commit d4f072ced3413dac8a502add6cc5b79c17bc8b4b.
> - Revert "[builtins] Don't mess with entered context for MicrotaskCallbacks."
>   This reverts commit 6703dacdd6e4c0e0da4085cfc46e7291ef78949c.
> - Revert "[debugger] Properly deal with settled promises in catch prediction."
>   This reverts commit 40dd065823a87e671fe6cb0bba7197bd28833f1d.
> - Revert "[builtins] Widen the fast-path for Promise builtins."
>   This reverts commit db0556b7e8a2965a27be956e5ce2e2e2d832808c.
> - Revert "[builtins] Unify PerformPromiseThen and optimize it with TurboFan."
>   This reverts commit a582199c5e56c9c84312dfa6d6fa6de724e1a806.
> - Revert "[builtins] Remove obsolete PromiseBuiltinsAssembler::AppendPromiseCallback."
>   This reverts commit 6bf888529092326c59165d369baf083ca7cc519b.
> - Revert "[builtins] Turn NewPromiseCapability into a proper builtin."
>   This reverts commit 313b490ddd35367f5e7fe4a7073054ecd8a732ae.
> - Revert "[builtins] Inline InternalPromiseThen into it's only caller"
>   This reverts commit f7bd6a2fd65e7b8ae90574d8411aeb5695c40716.
> - Revert "[builtins] Implement Promise#catch by really calling into Promise#then."
>   This reverts commit b23b098fa02e24c0b1551f6b6a85619194af76ed.
> - Revert "[promise] Remove incorrect fast path"
>   This reverts commit 0f6eafe85585940fc118e1c133d939c539e88f29.
> - Revert "[builtins] Squeeze JSPromise::result and JSPromise::reactions into a single field."
>   This reverts commit 8a677a28312855955d96a64caf91601d9196cc7b.
> - Revert "[builtins] Refactor promises to reduce GC overhead."
>   This reverts commit 8e7737cb5811dcb9bc9e125acd9d7d4e0cfcac70.
> 
> Tbr: hpayer@chromium.org
> Bug:  chromium:800651 , chromium:808911,  v8:5691 , v8:7253
> Change-Id: I8c8ea5ed32ed62f6cd8b0d027a3707ddd891e5f1
> Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
> Reviewed-on: https://chromium-review.googlesource.com/906991
> Commit-Queue: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Adam Klein <adamk@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51158}

Change-Id: I09d958cbebd635a325809072a290f2f53df8c5d4
Tbr: adamk@chromium.org,yangguo@chromium.org,bmeurer@chromium.org
Bug:  chromium:800651 , chromium:808911,  v8:5691 , v8:7253
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/908988
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51181}
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/include/v8.h
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/api.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/bootstrapper.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/builtins/builtins-async-gen.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/builtins/builtins-async-iterator-gen.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/builtins/builtins-definitions.h
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/builtins/builtins-internal-gen.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/builtins/builtins-promise-gen.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/builtins/builtins-promise-gen.h
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/code-stub-assembler.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/code-stub-assembler.h
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/compiler/js-call-reducer.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/compiler/js-call-reducer.h
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/compiler/js-create-lowering.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/compiler/js-generic-lowering.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/compiler/js-operator.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/compiler/js-operator.h
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/compiler/opcodes.h
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/compiler/typer.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/compiler/types.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/compiler/verifier.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/contexts.h
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/factory.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/factory.h
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/heap-symbols.h
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/heap/heap.h
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/heap/setup-heap-internal.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/isolate.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/isolate.h
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/lookup.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/lookup.h
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/objects-debug.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/objects-inl.h
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/objects-printer.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/objects.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/objects.h
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/objects/map-inl.h
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/objects/map.h
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/profiler/heap-snapshot-generator.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/runtime/runtime-debug.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/src/runtime/runtime-promise.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/test/cctest/heap/test-heap.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/test/cctest/test-api.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/test/cctest/test-code-stub-assembler.cc
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/test/cctest/test-heap-profiler.cc
[add] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/test/debugger/regress/regress-crbug-808973.js
[add] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/test/mjsunit/compiler/promise-prototype-catch-custom-then-1.js
[add] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/test/mjsunit/compiler/promise-prototype-catch-custom-then-2.js
[add] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/test/mjsunit/compiler/promise-prototype-catch-subclass.js
[add] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/test/mjsunit/compiler/promise-prototype-catch.js
[add] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/test/mjsunit/compiler/promise-prototype-finally-custom-then-1.js
[add] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/test/mjsunit/compiler/promise-prototype-finally-custom-then-2.js
[add] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/test/mjsunit/compiler/promise-prototype-finally-subclass.js
[add] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/test/mjsunit/compiler/promise-prototype-finally.js
[add] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/test/mjsunit/compiler/promise-prototype-then.js
[add] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/test/mjsunit/regress/regress-5691.js
[add] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/test/mjsunit/regress/regress-800651.js
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/test/webkit/fast/js/Promise-resolve-with-then-exception-expected.txt
[modify] https://crrev.com/3916401e4b359ca096119f42fc22cc5a45aeb4ea/tools/v8heapconst.py

Thanks for the heads up. I think it was just the mega revert (.. which has been relanded as per comment#23). I can't reproduce this locally with ToT (46488f71bb9b5efed2eb9433ac226c3798477d85) today.

 Issue 814919  has been merged into this issue.

Reopen since we still have the suppressions added in https://crrev.com/5e50857e2c40f11fd6ee3e17e52b20bf3dc3e2a8

Would it be save to remove the suppressions, then please assign the bug to me.

Re-assigning as per comment#26

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/34ba47dae9288fc5cc8fb5ce627e0aeedb1d8ad3

commit 34ba47dae9288fc5cc8fb5ce627e0aeedb1d8ad3
Author: Michael Achenbach <machenbach@chromium.org>
Date: Fri Feb 23 00:20:48 2018

[foozzie] Remove async suppressions

NOTRY=true
TBR=gsathya@chromium.org

Bug:  chromium:800651 
Change-Id: I9e978c430cbeef0fcf004d1cfbd1e64f15983155
Reviewed-on: https://chromium-review.googlesource.com/933294
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51490}
[modify] https://crrev.com/34ba47dae9288fc5cc8fb5ce627e0aeedb1d8ad3/tools/clusterfuzz/v8_suppressions.py