Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/b6f7ea580595f98b89fc47c50f9ccfbbd3b9c448 ([runtime] use new CloneObject bytecode for some ObjectLiteralSpread cases).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Fix is in progress in https://chromium-review.googlesource.com/c/v8/v8/+/1146297

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/d6efcbf02280155af632b47d51a13bbd2a10b6b0

commit d6efcbf02280155af632b47d51a13bbd2a10b6b0
Author: Caitlin Potter <caitp@igalia.com>
Date: Wed Jul 25 21:23:05 2018

[runtime] fix ClusterFuzz regressions (and remaining nits) in CloneObject

Includes fixes for several ClusterFuzz regressions:

1) fix an invalid Handle-cast in ic.cc (chromium:866282)

2) fix for improper accounting of used/unused inobject
fields, found by clusterfuzz (chromium:866357).

3) fix number of control outputs for the JSCloneObject
operator to be used by IfSuccess and IfException nodes (chromium:866727).

4) fix property constness in out-of-object properties of fast-cloned
object to be compatible with DCHECKs in StoreIC (chromium:866861).

Also includes the fixups missing from the initial commit, and
regression tests

BUG=v8:7611,  chromium:866282 ,  chromium:866357 ,  chromium:866727 ,  chromium:866861 
R=jkummerow@chromium.org, mvstanton@chromium.org
TBR=rmcilroy@chromium.org

Change-Id: I77220308482f16db2893c0dcebec36530d0f5540
Reviewed-on: https://chromium-review.googlesource.com/1146297
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54706}
[modify] https://crrev.com/d6efcbf02280155af632b47d51a13bbd2a10b6b0/src/compiler/js-operator.cc
[modify] https://crrev.com/d6efcbf02280155af632b47d51a13bbd2a10b6b0/src/ic/ic.cc
[modify] https://crrev.com/d6efcbf02280155af632b47d51a13bbd2a10b6b0/src/interpreter/bytecode-generator.cc
[modify] https://crrev.com/d6efcbf02280155af632b47d51a13bbd2a10b6b0/src/objects.cc
[modify] https://crrev.com/d6efcbf02280155af632b47d51a13bbd2a10b6b0/src/objects/map-inl.h
[modify] https://crrev.com/d6efcbf02280155af632b47d51a13bbd2a10b6b0/src/objects/map.h
[add] https://crrev.com/d6efcbf02280155af632b47d51a13bbd2a10b6b0/test/mjsunit/es9/regress/regress-866282.js
[add] https://crrev.com/d6efcbf02280155af632b47d51a13bbd2a10b6b0/test/mjsunit/es9/regress/regress-866357.js
[add] https://crrev.com/d6efcbf02280155af632b47d51a13bbd2a10b6b0/test/mjsunit/es9/regress/regress-866727.js
[add] https://crrev.com/d6efcbf02280155af632b47d51a13bbd2a10b6b0/test/mjsunit/es9/regress/regress-866861.js

ClusterFuzz has detected this issue as fixed in range 54705:54706.

Detailed report: https://clusterfuzz.com/testcase?key=6227679641337856

Fuzzer: ochang_js_fuzzer
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !v8::internal::FLAG_enable_slow_asserts || (object->IsJSReceiver()) in objects-i
  cast
  at<v8::internal::JSReceiver>
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=54594:54595
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=54705:54706

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6227679641337856

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6227679641337856 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug requires manual review: M69 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: amineer@(Android), kariahda@(iOS), cindyb@(ChromeOS), govind@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

+awhalley@ (Security TPM) for M69 merge review.

+awhalley@ (Security TPM) for merge review.

govind@ - good for 69

Approving merge to M69 branch 3497 based on comment #18. Please merge ASAP. Thank you.

Please merge your change to M69 branch 3497 by 4:00 PM PT, Monday (08/06) so we can pick it up for next week M69 beta release. Thank you.

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Jakob or Michael, could you please do the merge?

Why do people think that this needs a merge? Because sheriffbot said so in #6/#9? Why would sheriffbot say so? Just based on date/time of commits and branch points? The blamed commit (#2, r54594) is *not* in V8's 6.9 branch (which is based on r54504). I don't think there's anything to be done here. Am I missing something?

+mbarbella@ PTLA comment #24. Thank you.

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Dropping Merge-Approved label to silence nags. If someone has an answer to #24, we can re-add the label.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot