Bulk edit to remove recently filed RUNTIME_ASSERT bugs from the security triage queue.

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6306581746024448

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: RUNTIME_ASSERT
Crash Address: 
Crash State:
  map->IsMap() in src/heap/spaces.cc
  

Minimized Testcase (0.39 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95rgXY_8sp08wavjWIYkeBnOoUE8n64LsFKM4DJchkGlxxFEqDEzMVfmn4GR5cGf8UncaUkkUr6lVKGsH93laLW_uFyFRjlPYke8jU-gjSc_FAsTrlb2h5xEnph15AvWKwqQ5v0z3fsiyUtYo5r2VEPQZsmZg
var __v_20 = {};
function __f_17() { }
function __f_19(obj) {
  for (var __v_19 = 0; __v_19 < 26; __v_19++) {
    obj["__v_5" + __v_19] = 0;
  }
}
function __f_15(__v_18) {
new __f_17().__proto__ = __v_18;
    gc();
}
function __f_20() {
  var __v_18 = __v_20 ? new __f_17() : {};
    __f_19(__v_18);
    __f_15();
}
for (var __v_19 = 0; __v_19 < 4; __v_19++) {
  __f_20();
  var __v_17 = __f_20();
}


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This is not a ignition specific failure.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/4598356f1723da448daf0aee98610c85f754f6ce

commit 4598356f1723da448daf0aee98610c85f754f6ce
Author: ishell <ishell@chromium.org>
Date: Mon Apr 04 10:00:29 2016

Properly complete in-object slack tracking.

BUG= chromium:599003 
LOG=N

Review URL: https://codereview.chromium.org/1856653002

Cr-Commit-Position: refs/heads/master@{#35232}

[modify] https://crrev.com/4598356f1723da448daf0aee98610c85f754f6ce/src/objects.cc
[add] https://crrev.com/4598356f1723da448daf0aee98610c85f754f6ce/test/mjsunit/regress/regress-crbug-599003.js

[Automated comment] Less than 2 weeks to go before stable on M50, manual review required.

Merge approved for M50 (branch 2661). Pls go ahead merge.

Please merge your change to M50 branch 2661 before 4:00 PM PST today if you like to make it to this week beta. We're cutting beta candidate today.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/2619c5e99683ffb62a66b8cafa3545377c1bc521

commit 2619c5e99683ffb62a66b8cafa3545377c1bc521
Author: ishell@chromium.org <ishell@chromium.org>
Date: Tue Apr 05 19:11:42 2016

Version 5.0.71.30 (cherry-pick)

Merged 4598356f1723da448daf0aee98610c85f754f6ce

Properly complete in-object slack tracking.

BUG= chromium:599003 
LOG=N
R=littledan@chromium.org
TBR=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1861073002 .

Cr-Commit-Position: refs/branch-heads/5.0@{#37}
Cr-Branched-From: ad16e6c2cbd2c6b0f2e8ff944ac245561c682ac2-refs/heads/5.0.71@{#1}
Cr-Branched-From: bd9df50d75125ee2ad37b3d92c8f50f0a8b5f030-refs/heads/master@{#34215}

[modify] https://crrev.com/2619c5e99683ffb62a66b8cafa3545377c1bc521/include/v8-version.h
[modify] https://crrev.com/2619c5e99683ffb62a66b8cafa3545377c1bc521/src/objects.cc
[add] https://crrev.com/2619c5e99683ffb62a66b8cafa3545377c1bc521/test/mjsunit/regress/regress-crbug-599003.js

Per Comment #14, this is already merged to M50. So removing "Merge-Approved-50" label. Please correct me if I'm missing anything here. Thank you.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot