Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/bf84766a2cd3e09070adcd6228a3a487c8dc4bbd ([CloneObjectIC] clone MutableHeapNumbers instead of referencing them).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

/cc igor, could this be caused by the missing write barrier for in object properties?

I think it's crashing in a in-object property copying loop while trying to treat unboxed double as a tagged value. I think https://chromium-review.googlesource.com/c/v8/v8/+/1323911 will fix it.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/3e010af274088493f3485d7a16dec4e31550e876

commit 3e010af274088493f3485d7a16dec4e31550e876
Author: Caitlin Potter <caitp@igalia.com>
Date: Thu Nov 08 19:14:11 2018

[CloneObjectIC] clone MutableHeapNumbers only if !FLAG_unbox_double_fields

Change the macros added in bf84766a2cd3e09070adcd6228a3a487c8dc4bbd to
only do the hard work if FLAG_unbox_double_fields is unset (otherwise,
they will attempt to dereference raw float64s, which is bad!)

Also adds a write barrier in CopyPropertyArrayValues for each store if
it's possible that a MutableHeapNumber is cloned.

BUG=chromium:901301,  chromium:902965 , chromium:903070, v8:7611
R=cbruni@chromium.org, jkummerow@chromium.org, ishell@chromium.org

Change-Id: I224d3c4e7b0a887684bff68985b4d97021ba4cfb
Reviewed-on: https://chromium-review.googlesource.com/c/1323911
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57368}
[modify] https://crrev.com/3e010af274088493f3485d7a16dec4e31550e876/src/builtins/builtins-constructor-gen.cc
[modify] https://crrev.com/3e010af274088493f3485d7a16dec4e31550e876/src/code-stub-assembler.cc
[modify] https://crrev.com/3e010af274088493f3485d7a16dec4e31550e876/src/ic/accessor-assembler.cc
[add] https://crrev.com/3e010af274088493f3485d7a16dec4e31550e876/test/mjsunit/es9/regress/regress-902965.js
[add] https://crrev.com/3e010af274088493f3485d7a16dec4e31550e876/test/mjsunit/es9/regress/regress-903070.js

ClusterFuzz has detected this issue as fixed in range 57367:57368.

Detailed report: https://clusterfuzz.com/testcase?key=5209962466508800

Fuzzer: ochang_js_fuzzer
Job Type: linux_ubsan_vptr_d8
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  Builtins_CloneObjectIC
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_d8&range=57303:57304
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_d8&range=57367:57368

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5209962466508800

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5209962466508800 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.