Issue 595616  has been merged into this issue.

I can reproduce the issue locally and have a patch in progress to address it.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/67bee8149a6d3d02f1e349919cbe86d87b452128

commit 67bee8149a6d3d02f1e349919cbe86d87b452128
Author: littledan <littledan@chromium.org>
Date: Thu Mar 17 21:51:07 2016

Throw exceptions from CreateDataProperty when should_throw

Previously, when a property was non-configurable or the object was
non-extensible, CreateDataProperty might just return false rather than
throwing, even if should_throw was on. This patch fixes that issue.

Tested by running the patch at https://codereview.chromium.org/1814933002
on top of this code and observing the tests to see an exception thrown.

R=adamk
BUG= chromium:595319 
LOG=Y

Review URL: https://codereview.chromium.org/1809233002

Cr-Commit-Position: refs/heads/master@{#34875}

[modify] https://crrev.com/67bee8149a6d3d02f1e349919cbe86d87b452128/src/objects.cc
[modify] https://crrev.com/67bee8149a6d3d02f1e349919cbe86d87b452128/src/objects.h

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/7acee1ef61ce2afd6dd8688499fad7475bcd82cd

commit 7acee1ef61ce2afd6dd8688499fad7475bcd82cd
Author: littledan <littledan@chromium.org>
Date: Thu Mar 17 22:41:24 2016

Throw the right exceptions from setting elements in Array.prototype.concat

This patch fixes two bugs in Array.prototype.concat in conjunction with
subclassing Arrays:
- Create a new property rather than calling Set when adding elements to
  the output array. This means setters are not called.
- If there is an exception thrown from DefineProperty, propagate it
  outwards properly, rather than swallowing it. This can occur, e.g., with
  a Proxy as the new output array.

R=adamk
LOG=Y
BUG= chromium:595319 

Review URL: https://codereview.chromium.org/1814933002

Cr-Commit-Position: refs/heads/master@{#34876}

[modify] https://crrev.com/7acee1ef61ce2afd6dd8688499fad7475bcd82cd/src/builtins.cc
[add] https://crrev.com/7acee1ef61ce2afd6dd8688499fad7475bcd82cd/test/mjsunit/regress/regress-595319.js

ClusterFuzz has detected this issue as fixed in range 34875:34876.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6097543900954624

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_mipsel_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !isolate->has_pending_exception() in src/compiler.cc
  
Regressed: V8: r34225:34226
Fixed: V8: r34875:34876

Minimized Testcase (0.24 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96ZanWfyJQFqeAXJAxazBCRD9OL7PQ7V6ZwHIrAhgb7ZtZ-oySDkRFQiIUnzEURxCV4OaIm--sxE2vtVTYdGgP7rwER8E8Ce6xmCGRgA07GskjtwHSoB9zkgf7oZJ2ezu7tPP-V8XRmdD-3yGQPR5isr60Y_g
Object.prototype.__defineGetter__(0, function(){});
class MyArray extends Array { }
Object.prototype.constructor = MyArray;
delete Array.prototype.constructor;
var __v_3 = new Array();
__v_3 = __v_3.concat(0.5);
function __f_4() {
}
  __f_4.apply();


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot