Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/9eca23e9ed075f49d70dae0fb6fba1e7c9a23331 ([turbofan] Inline Number constructor in certain cases).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

ClusterFuzz has detected this issue as fixed in range 54543:54544.

Detailed report: https://clusterfuzz.com/testcase?key=5555624767913984

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition:x64,trusted
  sources: f1a
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=v8_foozzie&range=54453:54454
Fixed: https://clusterfuzz.com/revisions?job=v8_foozzie&range=54543:54544

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5555624767913984

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5555624767913984 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

 Issue 864311  has been merged into this issue.

The fixing commit is this revert:

https://chromium.googlesource.com/v8/v8/+/c7a9af61e6bf1f7de9b8889a2517e4bd75dc9e2a

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/1fb27dad680256c9d3ef389a04ca3637bfd22f09

commit 1fb27dad680256c9d3ef389a04ca3637bfd22f09
Author: Sigurd Schneider <sigurds@chromium.org>
Date: Fri Jul 20 09:23:59 2018

Merged: Revert "[turbofan] Inline Number constructor in certain cases"

Revision: c7a9af61e6bf1f7de9b8889a2517e4bd75dc9e2a

BUG= v8:7904 ,  chromium:865310 
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=neis@chromium.org

Change-Id: I3024e98aed155c8d7871b05b9b7c9efedb1c5303
Reviewed-on: https://chromium-review.googlesource.com/1144930
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.9@{#7}
Cr-Branched-From: d7b61abe7b48928aed739f02bf7695732d359e7e-refs/heads/6.9.427@{#1}
Cr-Branched-From: b7e108d6016bf6b7de3a34e6d61cb522f5193460-refs/heads/master@{#54504}
[modify] https://crrev.com/1fb27dad680256c9d3ef389a04ca3637bfd22f09/src/builtins/builtins-conversion-gen.cc
[modify] https://crrev.com/1fb27dad680256c9d3ef389a04ca3637bfd22f09/src/builtins/builtins-definitions.h
[modify] https://crrev.com/1fb27dad680256c9d3ef389a04ca3637bfd22f09/src/compiler/js-call-reducer.cc
[modify] https://crrev.com/1fb27dad680256c9d3ef389a04ca3637bfd22f09/src/compiler/js-call-reducer.h
[modify] https://crrev.com/1fb27dad680256c9d3ef389a04ca3637bfd22f09/src/compiler/js-generic-lowering.cc
[modify] https://crrev.com/1fb27dad680256c9d3ef389a04ca3637bfd22f09/src/compiler/js-operator.cc
[modify] https://crrev.com/1fb27dad680256c9d3ef389a04ca3637bfd22f09/src/compiler/js-operator.h
[modify] https://crrev.com/1fb27dad680256c9d3ef389a04ca3637bfd22f09/src/compiler/js-typed-lowering.cc
[modify] https://crrev.com/1fb27dad680256c9d3ef389a04ca3637bfd22f09/src/compiler/loop-variable-optimizer.cc
[modify] https://crrev.com/1fb27dad680256c9d3ef389a04ca3637bfd22f09/src/compiler/node-properties.cc
[modify] https://crrev.com/1fb27dad680256c9d3ef389a04ca3637bfd22f09/src/compiler/opcodes.h
[modify] https://crrev.com/1fb27dad680256c9d3ef389a04ca3637bfd22f09/src/compiler/operation-typer.cc
[modify] https://crrev.com/1fb27dad680256c9d3ef389a04ca3637bfd22f09/src/compiler/operation-typer.h
[modify] https://crrev.com/1fb27dad680256c9d3ef389a04ca3637bfd22f09/src/compiler/operator-properties.cc
[modify] https://crrev.com/1fb27dad680256c9d3ef389a04ca3637bfd22f09/src/compiler/simplified-lowering.cc
[modify] https://crrev.com/1fb27dad680256c9d3ef389a04ca3637bfd22f09/src/compiler/simplified-lowering.h
[modify] https://crrev.com/1fb27dad680256c9d3ef389a04ca3637bfd22f09/src/compiler/typer.cc
[modify] https://crrev.com/1fb27dad680256c9d3ef389a04ca3637bfd22f09/src/compiler/verifier.cc
[modify] https://crrev.com/1fb27dad680256c9d3ef389a04ca3637bfd22f09/test/cctest/compiler/test-js-typed-lowering.cc
[modify] https://crrev.com/1fb27dad680256c9d3ef389a04ca3637bfd22f09/test/js-perf-test/JSTests.json
[delete] https://crrev.com/d157d6995ce2f4a559dbc0c993344e1364db62b1/test/js-perf-test/Numbers/run.js
[delete] https://crrev.com/d157d6995ce2f4a559dbc0c993344e1364db62b1/test/js-perf-test/Numbers/toNumber.js
[delete] https://crrev.com/d157d6995ce2f4a559dbc0c993344e1364db62b1/test/mjsunit/harmony/bigint/regress-tonumbercode.js
[modify] https://crrev.com/1fb27dad680256c9d3ef389a04ca3637bfd22f09/test/mjsunit/harmony/bigint/turbo.js

Thanks!