This is due to a bogus assertion introduced in 232cd81aba334639be0ac1047ee03345ece805d3 Fix upcoming.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/d1f68f776eafa62d4bd1cc3465d18c2e47473381

commit d1f68f776eafa62d4bd1cc3465d18c2e47473381
Author: yangguo <yangguo@chromium.org>
Date: Wed Mar 09 15:54:54 2016

[regexp] fix bogus assertion in CharacterRange constructor.

The CharacterRange constructor checks the input for validity. However,
CharacterRange::Singleton also uses the constructor and may have
kEndMarker as input, causing the check to fail.

The solution is to move the check to CharacterRange::Range and
consistently use it across the code base.

R=jkummerow@chromium.org
BUG= chromium:593282 
LOG=N

Review URL: https://codereview.chromium.org/1776013003

Cr-Commit-Position: refs/heads/master@{#34626}

[modify] https://crrev.com/d1f68f776eafa62d4bd1cc3465d18c2e47473381/src/regexp/jsregexp.cc
[modify] https://crrev.com/d1f68f776eafa62d4bd1cc3465d18c2e47473381/src/regexp/regexp-ast.h
[modify] https://crrev.com/d1f68f776eafa62d4bd1cc3465d18c2e47473381/test/cctest/test-regexp.cc
[add] https://crrev.com/d1f68f776eafa62d4bd1cc3465d18c2e47473381/test/mjsunit/regress/regress-crbug-593282.js

ClusterFuzz has detected this issue as fixed in range 34625:34626.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4871428951769088

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  0 <= from && to <= String::kMaxCodePoint in src/regexp/regexp-ast.h
  
Regressed: V8: r34528:34529
Fixed: V8: r34625:34626

Minimized Testcase (0.59 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95cDNjvZg6z-2VmDdvyq4vCSOjtlyQ1JzUm_KwoscNB5Fum4vtPtdi0dfK-NONFWz6gGW1v8KFd7U1uOIyJaDslhrw5QT77VWxV2dey8kkmNRDqLomkt-9bO_poBYPkZuHSPe2sEGbOVroaJYg7jca9fm7LoA

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/c8a0cf00a399184ec1b51140a7a241fa4d2ad13a

commit c8a0cf00a399184ec1b51140a7a241fa4d2ad13a
Author: Yang Guo <yangguo@chromium.org>
Date: Mon Mar 14 10:07:33 2016

Version 5.0.71.17 (cherry-pick)

Merged f9d7c711afe0389e9c6c48f6653312017109cb6f
Merged 2947b2fa6fcebb349f66818b15b063a32ef71b05
Merged d1f68f776eafa62d4bd1cc3465d18c2e47473381

[regexp] Fix off-by-one in CharacterRange::Negate.

Fix compile error on arm.

[regexp] fix bogus assertion in CharacterRange constructor.

BUG= chromium:592343 , chromium:593282 
LOG=N
TBR=hablich@chromium.org

Review URL: https://codereview.chromium.org/1801573002 .

Cr-Commit-Position: refs/branch-heads/5.0@{#23}
Cr-Branched-From: ad16e6c2cbd2c6b0f2e8ff944ac245561c682ac2-refs/heads/5.0.71@{#1}
Cr-Branched-From: bd9df50d75125ee2ad37b3d92c8f50f0a8b5f030-refs/heads/master@{#34215}

[modify] https://crrev.com/c8a0cf00a399184ec1b51140a7a241fa4d2ad13a/include/v8-version.h
[modify] https://crrev.com/c8a0cf00a399184ec1b51140a7a241fa4d2ad13a/src/regexp/jsregexp.cc
[modify] https://crrev.com/c8a0cf00a399184ec1b51140a7a241fa4d2ad13a/src/regexp/jsregexp.h
[modify] https://crrev.com/c8a0cf00a399184ec1b51140a7a241fa4d2ad13a/src/regexp/regexp-ast.h
[modify] https://crrev.com/c8a0cf00a399184ec1b51140a7a241fa4d2ad13a/test/cctest/test-regexp.cc
[add] https://crrev.com/c8a0cf00a399184ec1b51140a7a241fa4d2ad13a/test/mjsunit/regress/regress-crbug-592343.js
[add] https://crrev.com/c8a0cf00a399184ec1b51140a7a241fa4d2ad13a/test/mjsunit/regress/regress-crbug-593282.js

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot