Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/3e43ded932000faa4307a9e97f470fe4974813c9 ([turbofan] Escape analysis support for LoadElement with variable index.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/63f92a9f31614f6d2afc04e52c2ba721a495b312

commit 63f92a9f31614f6d2afc04e52c2ba721a495b312
Author: Benedikt Meurer <bmeurer@chromium.org>
Date: Mon Oct 15 07:11:58 2018

[turbofan] Fix representation selection of CheckFloat64Hole.

Properly handle the case where the CheckFloat64Hole becomes a
no-op after RETYPE (because the feedback type is already Number).
We always need to pass the Number restriction type here.

Bug:  chromium:895199 
Change-Id: I96a949ba35db1e6d35abedddc4507c101d95b716
Reviewed-on: https://chromium-review.googlesource.com/c/1278804
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56622}
[modify] https://crrev.com/63f92a9f31614f6d2afc04e52c2ba721a495b312/src/compiler/simplified-lowering.cc
[add] https://crrev.com/63f92a9f31614f6d2afc04e52c2ba721a495b312/test/mjsunit/regress/regress-crbug-895199.js

ClusterFuzz has detected this issue as fixed in range 56621:56622.

Detailed report: https://clusterfuzz.com/testcase?key=6279506535645184

Fuzzer: ochang_js_fuzzer
Job Type: linux_asan_d8_v8_arm64_dbg
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  restriction_type.Is(info->restriction_type()) in simplified-lowering.cc
  v8::internal::compiler::RepresentationSelector::SetOutput
  v8::internal::compiler::RepresentationSelector::VisitUnop
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_v8_arm64_dbg&range=56441:56442
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_v8_arm64_dbg&range=56621:56622

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6279506535645184

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6279506535645184 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot