Issue 599066  has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/8a9ada486318eea3a03c0526fa9d7674ebe011a5

commit 8a9ada486318eea3a03c0526fa9d7674ebe011a5
Author: mythria <mythria@chromium.org>
Date: Fri Apr 01 13:12:49 2016

[Interpreter] Handles BytecodeArrays when scanning objects in heap.

Handles bytecodeArray Objects when verifying the heap and also when
collecting code statistics. The changes include:
1. BytecodeArrays could be a part of the large object space. When
verifying the large object space we should also allow BytecodeArray
objects.
2. Adds support for BytecodeArrays when collecting code statistics.

BUG= v8:4280 , chromium:599001 
LOG=N

Review URL: https://codereview.chromium.org/1850443006

Cr-Commit-Position: refs/heads/master@{#35202}

[modify] https://crrev.com/8a9ada486318eea3a03c0526fa9d7674ebe011a5/src/heap/spaces.cc
[add] https://crrev.com/8a9ada486318eea3a03c0526fa9d7674ebe011a5/test/mjsunit/ignition/regress-599001-verifyheap.js

ClusterFuzz has detected this issue as fixed in range 35201:35202.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5723067220754432

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  object->IsCode() || object->IsSeqString() || object->IsExternalString() || objec
  
Fixed: V8: r35201:35202

Minimized Testcase (7.92 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94ex8NjaEu-3nV_dljJTU_o--GnjbMWa6-us3p4pFTI1pT7CeV17OEGxuJZiBdsFUd_2c-RAWjS1PgyxuHsDhk4ZNIif18u6qh4ub396_IIY85yG0BhVNSD5t7TqvQWOckj9hjljN-nXr6PEYRJGfAAnBNc2Q

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot