The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/a7a14fdebcd686e89a6039d0d29b751c40b6027a

commit a7a14fdebcd686e89a6039d0d29b751c40b6027a
Author: ishell <ishell@chromium.org>
Date: Mon May 23 09:00:07 2016

[runtime] Don't crash when trying to access manually constructed CallSite object.

... but hit the runtime assert instead.
|
| Runtime error in ../src/runtime/runtime-internal.cc, line 409
|
| call_site.IsJavaScript() || call_site.IsWasm()
|

BUG= chromium:613905 
LOG=N

Review-Url: https://codereview.chromium.org/2006603002
Cr-Commit-Position: refs/heads/master@{#36430}

[modify] https://crrev.com/a7a14fdebcd686e89a6039d0d29b751c40b6027a/src/messages.cc
[add] https://crrev.com/a7a14fdebcd686e89a6039d0d29b751c40b6027a/test/mjsunit/regress/regress-crbug-613905.js

ClusterFuzz has detected this issue as fixed in range 36429:36430.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4593569394589696

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x0000dfff7fff
Crash State:
  v8::base::NoBarrier_Load
  v8::internal::HeapObject::map_word
  v8::internal::HeapObject::map
  
Recommended Security Severity: Medium

Regressed: V8: r36347:36348
Fixed: V8: r36429:36430

Minimized Testcase (0.24 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97gw7iYR0-wqmuFoM0TzX90sW_OIlWOIH3t3GR3DqiaBmlXMgPwY08q589aQHXVmFXs1wPxotmx8fH32SRWjb46S9vG3ChbG4i4_zCdTH4OVhV-iryIUYdvpbLcasxgnsApaXYEDBTFBC76QF1Yiwea77AvdQ
Error.prepareStackTrace = (e,s) => s;
__v_6 = Error().stack[0].constructor;
function __f_2() {
  return __v_6;
}
function __f_5(a, b, c) {
  return a + __f_2()(b, c);
}
function __f_6(a, b, c) {
  var __v_3 = __f_5(a, b, c);
}
__f_6( 2, 3, 6);


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Adding Merge-Triage label for tracking purposes.

Once your fix had sufficient bake time (on canary, dev as appropriate), please nominate your fix for merge by adding the Merge-Request-XX label, where XX is the Chrome milestone.

When your merge is approved by the release manager, please start merging with higher milestone label first. Make sure to re-request merge for every milestone in the label list. You can get branch information on omahaproxy.appspot.com.

- Your friendly ClusterFuzz

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot