Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/d2681aa448233d0990ea73e500f48a213de77a76 ([turbofan] Widen fast-path of Array.p.reduce[Right]).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

 Issue 805168  has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/8d1526b6fb3a0c05c9d231aeb233e11fcd5307d0

commit 8d1526b6fb3a0c05c9d231aeb233e11fcd5307d0
Author: Sigurd Schneider <sigurds@chromium.org>
Date: Thu Jan 25 10:06:38 2018

[turbofan] Fix bug in Array.p.reduce[Right]

Array.p.reduce[Right] did not correctly treat holey arrays
when dealing with mixed holey/non-holey receiver maps.

Bug:  chromium:804956 
Change-Id: Ic22f64a1beeb93005809948299cde1f1d21a0f19
Reviewed-on: https://chromium-review.googlesource.com/883241
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50864}
[modify] https://crrev.com/8d1526b6fb3a0c05c9d231aeb233e11fcd5307d0/src/elements-kind.cc
[modify] https://crrev.com/8d1526b6fb3a0c05c9d231aeb233e11fcd5307d0/src/elements-kind.h
[modify] https://crrev.com/8d1526b6fb3a0c05c9d231aeb233e11fcd5307d0/test/mjsunit/array-reduce.js

ClusterFuzz testcase 4578265082888192 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

ClusterFuzz has detected this issue as fixed in range 50863:50864.

Detailed report: https://clusterfuzz.com/testcase?key=5859049966141440

Fuzzer: ochang_js_fuzzer
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: Ill
Crash Address: 0x7f6693c26018
Crash State:
  v8::internal::Isolate::PushCodeObjectsAndDie
  v8::internal::Isolate::PushStackTraceAndDie
  v8::internal::Isolate::PushStackTraceAndDie
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=50780:50781
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=50863:50864

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5859049966141440

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.