Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/a39fcbd2884445376297ea3b879fdadd96b78ed3 (Reland^2 "[Liftoff] Implement f32.copysign and f64.copysign").

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

https://chromium-review.googlesource.com/c/v8/v8/+/1221216

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/bf08329c16414adde45789e980a5a0cddb21203e

commit bf08329c16414adde45789e980a5a0cddb21203e
Author: Clemens Hammacher <clemensh@chromium.org>
Date: Wed Sep 12 16:10:20 2018

[Liftoff] Use better value for "undefined Register"

There is no "no_reg" LiftoffRegister, so we sometimes have to
initialize it to an arbitrary value, because it will be overwritten
later anyway. One solution would be to wrap it in base::Optional, but
that does not really reflect the right semantics, since it's not
optional, but just set at a later point.
So far, we used the register with code 0, but on some platforms (e.g.
mips), register 0 is not a Liftoff cache register. So just use the
first gp cache register instead.

R=ahaas@chromium.org

Bug:  chromium:883280 
Change-Id: I157384ad5a9ca6a20aa198f3217a7d754dc53e30
Reviewed-on: https://chromium-review.googlesource.com/1221216
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55835}
[modify] https://crrev.com/bf08329c16414adde45789e980a5a0cddb21203e/src/wasm/baseline/liftoff-assembler.cc
[modify] https://crrev.com/bf08329c16414adde45789e980a5a0cddb21203e/src/wasm/baseline/liftoff-compiler.cc

ClusterFuzz has detected this issue as fixed in range 55834:55835.

Detailed report: https://clusterfuzz.com/testcase?key=5533984447266816

Fuzzer: ochang_js_fuzzer
Job Type: linux_asan_d8_v8_mipsel_dbg
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  0 != kLiftoffAssemblerGpCacheRegs & reg.bit() in liftoff-register.h
  V8_Dcheck
  v8::internal::wasm::LiftoffRegister::LiftoffRegister
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_v8_mipsel_dbg&range=55816:55817
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_v8_mipsel_dbg&range=55834:55835

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5533984447266816

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5533984447266816 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot