Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/670fa86fd171670c86528fc0fad2b262ea19be74 ([CloneObjectIC] overwrite monomorphic/polymorphic feedback if deprecated).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

ClusterFuzz has detected this issue as fixed in range 54759:54760.

Detailed report: https://clusterfuzz.com/testcase?key=6182002127273984

Fuzzer: ochang_js_fuzzer
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  !object->IsClearedWeakHeapObject() in maybe-handles-inl.h
  v8::internal::MaybeObjectHandle::MaybeObjectHandle
  v8::internal::FeedbackNexus::ConfigureCloneObject
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=54757:54758
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=54759:54760

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6182002127273984

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6182002127273984 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/d9f6c685f008ab8b669492b1c10ec44a9883de76

commit d9f6c685f008ab8b669492b1c10ec44a9883de76
Author: Caitlin Potter <caitp@igalia.com>
Date: Tue Jul 31 04:11:05 2018

Reland [CloneObjectIC] overwrite monomorphic/polymorphic feedback if deprecated

An object with a deprecated Map which has already been cached in
CloneObjectIC feedback is still a valid Map for fast cloning --- but
to be consistent with other ICs, deprecated maps are ignored, and are
expected to be transitioned away from.

If the source object has a deprecated map, the instance is migrated.

BUG=v8:7611,  chromium:867958 ,  chromium:868586 
R=jkummerow@chromium.org, mvstanton@chromium.org

Change-Id: I477aec6c8d0ae1e1648a70e85d2fd46146521d1c
Reviewed-on: https://chromium-review.googlesource.com/1154143
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54799}
[modify] https://crrev.com/d9f6c685f008ab8b669492b1c10ec44a9883de76/src/feedback-vector.cc
[modify] https://crrev.com/d9f6c685f008ab8b669492b1c10ec44a9883de76/src/ic/ic.cc
[add] https://crrev.com/d9f6c685f008ab8b669492b1c10ec44a9883de76/test/mjsunit/es9/regress/regress-867958.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/3879e8bfe3c8c3fdf05e772f741feda3209304cf

commit 3879e8bfe3c8c3fdf05e772f741feda3209304cf
Author: Michael Achenbach <machenbach@chromium.org>
Date: Tue Jul 31 06:29:49 2018

Revert "Reland [CloneObjectIC] overwrite monomorphic/polymorphic feedback if deprecated"

This reverts commit d9f6c685f008ab8b669492b1c10ec44a9883de76.

Reason for revert:
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20-%20gc%20stress/17584

Original change's description:
> Reland [CloneObjectIC] overwrite monomorphic/polymorphic feedback if deprecated
> 
> An object with a deprecated Map which has already been cached in
> CloneObjectIC feedback is still a valid Map for fast cloning --- but
> to be consistent with other ICs, deprecated maps are ignored, and are
> expected to be transitioned away from.
> 
> If the source object has a deprecated map, the instance is migrated.
> 
> BUG=v8:7611,  chromium:867958 ,  chromium:868586 
> R=​jkummerow@chromium.org, mvstanton@chromium.org
> 
> Change-Id: I477aec6c8d0ae1e1648a70e85d2fd46146521d1c
> Reviewed-on: https://chromium-review.googlesource.com/1154143
> Commit-Queue: Caitlin Potter <caitp@igalia.com>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54799}

TBR=jkummerow@chromium.org,mvstanton@chromium.org,caitp@igalia.com

Change-Id: Ifcb422c3a692543490710d450590323524a6359a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7611,  chromium:867958 ,  chromium:868586 
Reviewed-on: https://chromium-review.googlesource.com/1155593
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54800}
[modify] https://crrev.com/3879e8bfe3c8c3fdf05e772f741feda3209304cf/src/feedback-vector.cc
[modify] https://crrev.com/3879e8bfe3c8c3fdf05e772f741feda3209304cf/src/ic/ic.cc
[delete] https://crrev.com/d9f6c685f008ab8b669492b1c10ec44a9883de76/test/mjsunit/es9/regress/regress-867958.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/5caee70b664e81ccd57453a64757573aeb070107

commit 5caee70b664e81ccd57453a64757573aeb070107
Author: Caitlin Potter <caitp@igalia.com>
Date: Wed Aug 01 00:30:11 2018

Reland "Reland [CloneObjectIC] overwrite monomorphic/polymorphic feedback if deprecated"

An object with a deprecated Map which has already been cached in
CloneObjectIC feedback is still a valid Map for fast cloning --- but
to be consistent with other ICs, deprecated maps are ignored, and are
expected to be transitioned away from.

If the source object has a deprecated map, the instance is migrated.

BUG=v8:7611,  chromium:867958 ,  chromium:868586 ,  chromium:869342 ,  chromium:869347 ,  chromium:869293 
R=jkummerow@chromium.org, mvstanton@chromium.org

Reviewed-on: https://chromium-review.googlesource.com/1154143
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#54799}
Change-Id: I6e2f7b28c41bb9bd6255441da0f209a97bce5e8f
Reviewed-on: https://chromium-review.googlesource.com/1157142
Cr-Commit-Position: refs/heads/master@{#54830}
[modify] https://crrev.com/5caee70b664e81ccd57453a64757573aeb070107/src/feedback-vector.cc
[modify] https://crrev.com/5caee70b664e81ccd57453a64757573aeb070107/src/ic/ic.cc
[add] https://crrev.com/5caee70b664e81ccd57453a64757573aeb070107/test/mjsunit/es9/regress/regress-867958.js
[add] https://crrev.com/5caee70b664e81ccd57453a64757573aeb070107/test/mjsunit/es9/regress/regress-869342.js

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot