Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/d9f6c685f008ab8b669492b1c10ec44a9883de76 (Reland [CloneObjectIC] overwrite monomorphic/polymorphic feedback if deprecated).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/5caee70b664e81ccd57453a64757573aeb070107

commit 5caee70b664e81ccd57453a64757573aeb070107
Author: Caitlin Potter <caitp@igalia.com>
Date: Wed Aug 01 00:30:11 2018

Reland "Reland [CloneObjectIC] overwrite monomorphic/polymorphic feedback if deprecated"

An object with a deprecated Map which has already been cached in
CloneObjectIC feedback is still a valid Map for fast cloning --- but
to be consistent with other ICs, deprecated maps are ignored, and are
expected to be transitioned away from.

If the source object has a deprecated map, the instance is migrated.

BUG=v8:7611,  chromium:867958 ,  chromium:868586 ,  chromium:869342 ,  chromium:869347 ,  chromium:869293 
R=jkummerow@chromium.org, mvstanton@chromium.org

Reviewed-on: https://chromium-review.googlesource.com/1154143
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#54799}
Change-Id: I6e2f7b28c41bb9bd6255441da0f209a97bce5e8f
Reviewed-on: https://chromium-review.googlesource.com/1157142
Cr-Commit-Position: refs/heads/master@{#54830}
[modify] https://crrev.com/5caee70b664e81ccd57453a64757573aeb070107/src/feedback-vector.cc
[modify] https://crrev.com/5caee70b664e81ccd57453a64757573aeb070107/src/ic/ic.cc
[add] https://crrev.com/5caee70b664e81ccd57453a64757573aeb070107/test/mjsunit/es9/regress/regress-867958.js
[add] https://crrev.com/5caee70b664e81ccd57453a64757573aeb070107/test/mjsunit/es9/regress/regress-869342.js

ClusterFuzz has detected this issue as fixed in range 54799:54800.

Detailed report: https://clusterfuzz.com/testcase?key=5017118253514752

Fuzzer: mbarbella_js_mutation
Job Type: linux_ubsan_vptr_d8
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000012
Crash State:
  v8::internal::FeedbackNexus::ConfigureCloneObject
  __RT_impl_Runtime_CloneObjectIC_Miss
  v8::internal::Runtime_CloneObjectIC_Miss
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_d8&range=54798:54799
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_d8&range=54799:54800

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5017118253514752

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5017118253514752 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.