Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/594803c94671fa19db1420f2b43023b75264e101 ([turbofan] Inline Function#bind in more cases.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

The suspected regression CL is from last October, so I'm marking this Impact-Stable.

The fuzzer triggered in linux_d8_dbg, so I'm also expanding to all Blink OSes.

bmeurer@, please take a look when you get a chance, as this is a High severity issue affecting Stable branch.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/aa3020565f44396bb772c3aa508700493956d4d8

commit aa3020565f44396bb772c3aa508700493956d4d8
Author: Benedikt Meurer <bmeurer@chromium.org>
Date: Tue Apr 03 07:30:47 2018

[turbofan] Properly test number of descriptors.

When peeking into descriptor arrays (for Function.prototype.bind
inlining), we need to check the number of descriptors rather than
the length of the DescriptorArray.

Bug:  chromium:825045 
Change-Id: I55dbe1544e5e4cb8e23d873961c71ed12294d89c
Reviewed-on: https://chromium-review.googlesource.com/991812
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52315}
[modify] https://crrev.com/aa3020565f44396bb772c3aa508700493956d4d8/src/compiler/js-call-reducer.cc
[add] https://crrev.com/aa3020565f44396bb772c3aa508700493956d4d8/test/mjsunit/regress/regress-crbug-825045.js

This bug requires manual review: We are only 13 days from stable.
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), josafat@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This will land in Canary tonight, so let's confirm once it has landed first! 

ClusterFuzz has detected this issue as fixed in range 52314:52315.

Detailed report: https://clusterfuzz.com/testcase?key=5170330226917376

Fuzzer: ochang_js_fuzzer
Job Type: linux_d8_dbg
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  descriptor_number < number_of_descriptors() in objects-inl.h
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_d8_dbg&range=48638:48639
Fixed: https://clusterfuzz.com/revisions?job=linux_d8_dbg&range=52314:52315

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5170330226917376

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5170330226917376 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

How does change in canary look?

friendly ping - can you please confirm how safe this merge is overall?

This fix should be merged today if it should be in the Android stable build

awhalley@, I guess we are not taking this high level security fix in M66

Apologies, should have set my OOO on monorail :-|

Change is good for 66 merge. Let's try and get it in anyway in case there's another chance to pick it up.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/17d66a38c99538c7e16b1b821d0d9a15b18d2d61

commit 17d66a38c99538c7e16b1b821d0d9a15b18d2d61
Author: Benedikt Meurer <bmeurer@google.com>
Date: Thu Apr 12 07:19:24 2018

Merged: [turbofan] Properly test number of descriptors.

Revision: aa3020565f44396bb772c3aa508700493956d4d8

BUG= chromium:825045 
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=jarin@chromium.org

Change-Id: I94c60d024db10da34ae0e87aefea8685a37fcc49
Reviewed-on: https://chromium-review.googlesource.com/1009622
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.6@{#47}
Cr-Branched-From: d500271571b92cb18dcd7b15885b51e8f437d640-refs/heads/6.6.346@{#1}
Cr-Branched-From: 265ef0b635f8761df7c89eb4e8ec9c1a6ebee184-refs/heads/master@{#51624}
[modify] https://crrev.com/17d66a38c99538c7e16b1b821d0d9a15b18d2d61/src/compiler/js-call-reducer.cc
[add] https://crrev.com/17d66a38c99538c7e16b1b821d0d9a15b18d2d61/test/mjsunit/regress/regress-crbug-825045.js

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot