Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/aff803454745935ba7843257fcf10dce41dc33b1 (Reland "[array] Implement Array.p.sort in Torque").

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

As far as I can tell, the following thing is happening:

Array.p.sort is called twice. With --no-opt the elements kind for the receiver (second sort call) is PACKED_ELEMENTS, while with --always-opt its PACKED_DOUBLE_ELEMENTS. The comparison functions sets x[0] to a string, causing a transition to the slowpath in the --always-opt case, but not in the --no-opt case.

Since the slow-path starts from scratch, it causes "defineGetter" to be called twice on the same array element resulting in a TypeError in the --always-opt case.

Correction of the last sentence in the previous comment:

Since the slow-path starts the sorting from scratch, the comparison function is called twice, and those the "__defineGetter__" is called on a string the second time around.

Won't fix since it is not specified how often the comparison function can be called during sorting.

ClusterFuzz testcase 6314293973483520 is still reproducing on tip-of-tree build (trunk).

If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase.

Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace.

ClusterFuzz has detected this issue as fixed in range 54165:54166.

Detailed report: https://clusterfuzz.com/testcase?key=6314293973483520

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition:x64,ignition_turbo_opt
  sources: a10
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=v8_foozzie&range=53510:53511
Fixed: https://clusterfuzz.com/revisions?job=v8_foozzie&range=54165:54166

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6314293973483520

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.