Automatically adding ccs based on suspected regression changelists:

[builtins] Port Array.p.join to Torque. by peter.wm.wong@gmail.com - https://chromium.googlesource.com/v8/v8/+/952c097679c5e16ae214595ad3b01381483eab7b

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.

Making Jakob the owner since Peter can't be made the owner.

Here's a reduced test-case:

 v11 = new Array(); 
 v11[0] = 0.1; v11[2] = 0.2; 
 Object.defineProperty(v11, 1, {
    get: function() {
 v11[0x80000] = 1; 
},
}); 
 v40 = new TypeError(v11); 

With the standard x64 debug build, I get:

assert 'index < buffer.fixedArray.length_intptr' failed at ../../src/builtins/array-join.tq:173:
Trace/BPT trap: 5

Yay Torque asserts!

Looks like changing the array's length during the join operation through a getter.

Peter, would you mind taking a look? Please include a regression test with your fix.

Good morning Clusterfuzz! Yup, I'll take a look now.

Fix in-flight: https://chromium-review.googlesource.com/c/v8/v8/+/1286957

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/7cb6c81b8f1b6bf4d090f6bc024e619824577271

commit 7cb6c81b8f1b6bf4d090f6bc024e619824577271
Author: peterwmwong <peter.wm.wong@gmail.com>
Date: Thu Oct 18 10:46:23 2018

[builtins] Fix Array.p.join handling of an index getter with side effects

When creating the buffer for the fall back, the initial entry was not
considered when calculating the size.

Bug:  chromium:896181 
Change-Id: I7f15bb1bdf31b3255db91b1fe8dcd68c76033980
Reviewed-on: https://chromium-review.googlesource.com/c/1286957
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#56768}
[modify] https://crrev.com/7cb6c81b8f1b6bf4d090f6bc024e619824577271/src/builtins/array-join.tq
[modify] https://crrev.com/7cb6c81b8f1b6bf4d090f6bc024e619824577271/test/mjsunit/array-join-index-getter-side-effects.js
[add] https://crrev.com/7cb6c81b8f1b6bf4d090f6bc024e619824577271/test/mjsunit/regress/regress-crbug-896181.js

Thanks!

ClusterFuzz has detected this issue as fixed in range 56767:56768.

Detailed report: https://clusterfuzz.com/testcase?key=6581335463034880

Fuzzer: v8_builtins_generator
Job Type: linux_msan_d8
Platform Id: linux

Crash Type: Ill
Crash Address: 0x55778908c983
Crash State:
  v8::internal::JSArray::ArrayJoinConcatToSequentialString
  v8::internal::Simulator::DoRuntimeCall
  v8::internal::Simulator::ExecuteInstruction
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_msan_d8&range=56698:56699
Fixed: https://clusterfuzz.com/revisions?job=linux_msan_d8&range=56767:56768

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6581335463034880

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6581335463034880 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.