ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5571416019173376

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_arm64_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  has_property_ in src/lookup.h
  
Regressed: V8: r34875:34876

Minimized Testcase (0.12 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv979Ykb4pSGJ_plH8I4XlSXtubWcsl3m47iBasm_Ya4Q-Ia1IoQn9c3I6s1bPNQbC6NXVAZrjRPj_EDoTewsigZltNhuw-vBUp6FYjF3eBsRFZCwMux2gJpGPO4TecO-z86L-lz-i7XNLt7HqMbMZEUIL-iWww
__v_0 = new Uint8Array(100);
array = new Array(10);
array.__proto__ = __v_0;
__v_2 = Array.prototype.concat.call(array);


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Fixed by https://codereview.chromium.org/1814933002

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/7a38462e8b0fb25543ce8975045bc1e13d11cd34

commit 7a38462e8b0fb25543ce8975045bc1e13d11cd34
Author: littledan <littledan@chromium.org>
Date: Tue Apr 05 16:55:16 2016

Ensure CreateDataProperty works correctly on TypedArrays

Previously, CreateDataProperty would fail a DCHECK when used to create
an integer indexed property on a TypedArray. This patch makes it throw
a TypeError instead. The issue came up when Array.prototype.concat
was repaired to use CreateDataProperty rather than SetElement; concat
can be tricked into making a new TypedArray if it is given an Array
whose prototype is a TypedArray. This patch prevents the issue.

R=adamk
LOG=Y
BUG= chromium:596394 

Review URL: https://codereview.chromium.org/1821723004

Cr-Commit-Position: refs/heads/master@{#35271}

[modify] https://crrev.com/7a38462e8b0fb25543ce8975045bc1e13d11cd34/src/objects.cc
[add] https://crrev.com/7a38462e8b0fb25543ce8975045bc1e13d11cd34/test/mjsunit/regress/regress-crbug-596394.js

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot