Might have to wait for the v8 roll to confirm that this is fixed. This is same as Pwn2own bug.

ClusterFuzz has detected this issue as fixed in range 40591:40592.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4699334508806144

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_ignition_v8_arm_dbg
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x65646e75
Crash State:
  v8::internal::String::GetFlatContent
  v8::internal::__RT_impl_Runtime_StringParseInt
  v8::internal::Runtime_StringParseInt
  
Recommended Security Severity: Medium

Fixed: V8: r40591:40592

Minimized Testcase (0.33 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97TBlIpcndtR4wnalEntzWRCKbWP3QHbMtiOuaU_8JNvXqu-kSXMnX6Q_ovvycK6QxeJmVKDUV35sZDJYm1saF04CELoxxU89FB8BzeCunyfKDegKuYwI99OJkEnckRgIBhyzfHy1FZM8dzieuK1xT9TDf_MQ?testcase_id=4699334508806144
function __f_2() {
}
try {
} catch(e) {; }
function __f_10() {
  __v_9 = new Set();
}
function __f_9() {
  __v_9.xyz = 0x826852f4;
}
__f_10();
__f_10();
%OptimizeFunctionOnNextCall(__f_10);
__f_10();
__f_9();
__f_9();
%OptimizeFunctionOnNextCall(__f_9);
__f_9();
__f_10();
__f_9();
parseInt();
(function() {
})();
function __f_16() {
}


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot