Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/cdaaa311515e8402936e33d593727a082c524d08 ([builtins] Reland Array.prototype.splice() Torque implementation.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

Suspect CL landed on Aug 20: https://chromium.googlesource.com/v8/v8/+/cdaaa311515e8402936e33d593727a082c524d08

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

ClusterFuzz has detected this issue as fixed in range 55288:55289.

Detailed report: https://clusterfuzz.com/testcase?key=5644985740034048

Fuzzer: ochang_js_fuzzer
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  Type cast failed in CAST(p_o) at ../../src/code-stub-assembler.h:351 in code-ass
  v8::internal::CheckObjectType
  libv8.so
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=55262:55263
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=55288:55289

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5644985740034048

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5644985740034048 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/fd334b3216488011b368ec4652819e08c38d0d36

commit fd334b3216488011b368ec4652819e08c38d0d36
Author: Mike Stanton <mvstanton@chromium.org>
Date: Tue Sep 04 13:18:23 2018

[builtins] Enable Torque Array.prototype.splice

Before, splice was implemented with a C++ fast path and a
comprehensive JavaScript version.

This impl. is entirely in Torque with a fastpath for SMI,
DOUBLE and OBJECT arrays, and a comprehensive slow path.
The same level of "sparse" array support as given by the
array.js implementation is included.

This reland addresses several issues:

* Removed "sparse" array support from splice.
* Addressed ClusterFuzz  issue 876443 :
  The test and code that uses the fix is in this CL.
  The fix in isolation can be seen here:
  https://chromium-review.googlesource.com/c/v8/v8/+/1199403
* Removed dead code in elements.cc

BUG= chromium:876443 ,  v8:8131 , v8:1956,  v8:7221 

Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I2d4a66c24ba1edabeca34e27e6ff8ee6136ed5f1
Reviewed-on: https://chromium-review.googlesource.com/1201783
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55610}
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/BUILD.gn
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/bootstrapper.cc
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/builtins/array-reverse.tq
[add] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/builtins/array-splice.tq
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/builtins/array.tq
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/builtins/base.tq
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/builtins/builtins-array.cc
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/builtins/builtins-definitions.h
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/code-stub-assembler.cc
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/code-stub-assembler.h
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/contexts.h
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/elements.cc
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/elements.h
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/flag-definitions.h
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/js/array.js
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/runtime/runtime-array.cc
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/runtime/runtime.h
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/test/mjsunit/array-functions-prototype-misc.js
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/test/mjsunit/array-splice.js
[add] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/test/mjsunit/regress/regress-crbug-876443.js
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/test/mjsunit/regress/regress-splice-large-index.js
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/test/mozilla/mozilla.status
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/test/test262/test262.status
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/test/webkit/array-splice.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/fd334b3216488011b368ec4652819e08c38d0d36

commit fd334b3216488011b368ec4652819e08c38d0d36
Author: Mike Stanton <mvstanton@chromium.org>
Date: Tue Sep 04 13:18:23 2018

[builtins] Enable Torque Array.prototype.splice

Before, splice was implemented with a C++ fast path and a
comprehensive JavaScript version.

This impl. is entirely in Torque with a fastpath for SMI,
DOUBLE and OBJECT arrays, and a comprehensive slow path.
The same level of "sparse" array support as given by the
array.js implementation is included.

This reland addresses several issues:

* Removed "sparse" array support from splice.
* Addressed ClusterFuzz  issue 876443 :
  The test and code that uses the fix is in this CL.
  The fix in isolation can be seen here:
  https://chromium-review.googlesource.com/c/v8/v8/+/1199403
* Removed dead code in elements.cc

BUG= chromium:876443 ,  v8:8131 , v8:1956,  v8:7221 

Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I2d4a66c24ba1edabeca34e27e6ff8ee6136ed5f1
Reviewed-on: https://chromium-review.googlesource.com/1201783
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55610}
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/BUILD.gn
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/bootstrapper.cc
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/builtins/array-reverse.tq
[add] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/builtins/array-splice.tq
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/builtins/array.tq
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/builtins/base.tq
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/builtins/builtins-array.cc
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/builtins/builtins-definitions.h
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/code-stub-assembler.cc
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/code-stub-assembler.h
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/contexts.h
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/elements.cc
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/elements.h
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/flag-definitions.h
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/js/array.js
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/runtime/runtime-array.cc
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/runtime/runtime.h
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/test/mjsunit/array-functions-prototype-misc.js
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/test/mjsunit/array-splice.js
[add] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/test/mjsunit/regress/regress-crbug-876443.js
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/test/mjsunit/regress/regress-splice-large-index.js
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/test/mozilla/mozilla.status
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/test/test262/test262.status
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/test/webkit/array-splice.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/fd334b3216488011b368ec4652819e08c38d0d36

commit fd334b3216488011b368ec4652819e08c38d0d36
Author: Mike Stanton <mvstanton@chromium.org>
Date: Tue Sep 04 13:18:23 2018

[builtins] Enable Torque Array.prototype.splice

Before, splice was implemented with a C++ fast path and a
comprehensive JavaScript version.

This impl. is entirely in Torque with a fastpath for SMI,
DOUBLE and OBJECT arrays, and a comprehensive slow path.
The same level of "sparse" array support as given by the
array.js implementation is included.

This reland addresses several issues:

* Removed "sparse" array support from splice.
* Addressed ClusterFuzz  issue 876443 :
  The test and code that uses the fix is in this CL.
  The fix in isolation can be seen here:
  https://chromium-review.googlesource.com/c/v8/v8/+/1199403
* Removed dead code in elements.cc

BUG= chromium:876443 ,  v8:8131 , v8:1956,  v8:7221 

Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I2d4a66c24ba1edabeca34e27e6ff8ee6136ed5f1
Reviewed-on: https://chromium-review.googlesource.com/1201783
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55610}
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/BUILD.gn
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/bootstrapper.cc
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/builtins/array-reverse.tq
[add] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/builtins/array-splice.tq
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/builtins/array.tq
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/builtins/base.tq
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/builtins/builtins-array.cc
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/builtins/builtins-definitions.h
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/code-stub-assembler.cc
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/code-stub-assembler.h
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/contexts.h
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/elements.cc
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/elements.h
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/flag-definitions.h
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/js/array.js
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/runtime/runtime-array.cc
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/src/runtime/runtime.h
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/test/mjsunit/array-functions-prototype-misc.js
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/test/mjsunit/array-splice.js
[add] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/test/mjsunit/regress/regress-crbug-876443.js
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/test/mjsunit/regress/regress-splice-large-index.js
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/test/mozilla/mozilla.status
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/test/test262/test262.status
[modify] https://crrev.com/fd334b3216488011b368ec4652819e08c38d0d36/test/webkit/array-splice.js

Should we consider this for an M70 merge?

mvstanton - fix seems pretty big for an M70 merge this late in the game, but open to your thoughts.

Is the fix for this bug (https://chromium-review.googlesource.com/c/v8/v8/+/1199403) dependent on the other changes, or could it be merged to 70 independently? 

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot