Automatically adding ccs based on suspected regression changelists:

[builtins] Re-enable Set and WeakSet constructor fast path. by peter.wm.wong@gmail.com - https://chromium.googlesource.com/v8/v8/+/9c5053bf4d2f2ebc4973f51ff46a0b93b95d154d

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.

Peter PTAL. Repro:

  switch (typeof value) {
  }
Object.getPrototypeOf([])[Symbol.iterator] = () => assertUnreachable();
print("v8-foozzie source: /v8/test/mjsunit/regress/regress-784990.js");
const set = new Set([]);

// Output:
# Compared x64,ignition with x64,slow_path
#
# Flags of x64,ignition:
--abort_on_stack_or_string_length_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --es-staging --random-seed -2141613368 --turbo-filter=~ --noopt --suppress-asm-messages
# Flags of x64,slow_path:
--abort_on_stack_or_string_length_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --es-staging --random-seed -2141613368 --force-slow-path --suppress-asm-messages
#
# Difference:
+ /mnt/scratch0/clusterfuzz/slave-bot/inputs/fuzzer-testcases/fuzz-02245.js:3: ReferenceError: assertUnreachable is not defined
#
# Source file:
/v8/test/mjsunit/regress/regress-784990.js
#
### Start of configuration x64,ignition:
v8-foozzie source: /v8/test/mjsunit/regress/regress-784990.js
### End of configuration x64,ignition
#
### Start of configuration x64,slow_path:
v8-foozzie source: /v8/test/mjsunit/regress/regress-784990.js
/mnt/scratch0/clusterfuzz/slave-bot/inputs/fuzzer-testcases/fuzz-02245.js:3: ReferenceError: assertUnreachable is not defined
Object.getPrototypeOf([])[Symbol.iterator] = () => assertUnreachable();
^
### End of configuration x64,slow_path

This is a duplicate of  issue 804188 .  Array.prototype is modified in both issues, Array.prototype is just resolved in different ways (Array.prototype vs Object.getPrototypeOf([]))

Just to be sure, I've verified my in-flight fix https://chromium-review.googlesource.com/c/v8/v8/+/883065 does indeed resolve this issue too.

Thanks, marking as dupe then.

ClusterFuzz has detected this issue as fixed in range 50866:50867.

Detailed report: https://clusterfuzz.com/testcase?key=4595628427706368

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition:x64,slow_path
  sources: 220
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=v8_foozzie&range=50690:50691
Fixed: https://clusterfuzz.com/revisions?job=v8_foozzie&range=50866:50867

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4595628427706368

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.