ClusterFuzz has detected this issue as fixed in range 400696:400711.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6337998404976640

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  Marking::IsBlack(Marking::MarkBitFrom(object)) in mark-compact.cc
  v8::base::OS::Abort
  V8_Fatal
  v8::internal::VerifyAllBlackObjects
  
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=400696:400711

Minimized Testcase (0.18 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94lE2umg9hlAjt59pnMtSLc_9TdY75bm2K8zNFX9kM-M1r-uwtXdd2RYG6nmy4taV6pRrv1TG_kZQKHeNAcSt5zD9TCglgUN3i8KCBx8VF5oAxCPnRXFBhMEOMsXT6ZlLX-o1OHVNprAaaDGghsR-m-4U4UkQ?testcase_id=6337998404976640
<script>
var o0 = [];
var o1 = [];
o1.__defineGetter__(0, function() {
	o0.shift();
	for(i=0;i<100;i++)
		o0.push(0x23232323);
	gc();
	o0.concat(o1);
});
o1.concat();
</script>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

as per comment#3, marking the bug as fixed.

FYI: The same left-trimming issue as in  issue 620553 .

We need two commits:
  d800a65967b115c6e1aa6c3ba08861a304383088
  7a88ff3cc096ecd681e9d10ad0a75c7d3daf027e

 Issue 623715  has been merged into this issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot