This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

ClusterFuzz has detected this issue as fixed in range 400191:400261.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4962179350790144

Fuzzer: v8_builtins_generator
Job Type: linux_cfi_d8
Platform Id: linux

Crash Type: Bad-cast
Crash Address: 0x000000cbe8d0
Crash State:
  Bad-cast to v8::internal::PagedSpace from v8::internal::SemiSpace
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_d8&range=399887:399944
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_cfi_d8&range=400191:400261

Minimized Testcase (0.20 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95pKvWJwPLI4YPNYZ4xM_ACPz0LSdc7RSThdqFYjVUDwSCLieHUPYbpG7_r8L5rEuKm-KPiW5mJcYuxE1arGQ7mV1ocTNGn_cmUry8owmB0JAIOFniCv64ytQannuExDO0YOegMrA73JSk_DkJz20ArRRYSyQ
 v1 = Array(0x8000); 
Object.prototype.__defineGetter__(0, function() { 
    v7 = this;
this[2] = Array(0x8000).join("a");
})
try { v12 = new Intl.v8BreakIterator(); } catch (e) {  }
 v21 = Math.round(v7); 


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot