jochen @ could you please look into this.please feel free to re-assigned back if needed. thanks in advance !

Regression range points to 86d0dd362f627a7831b042d4fe8baa121c976fc4. Note that it doesn't seem specific to arm64 (i.e. reproduces on x64 as well).

could be a failed Assert imfrom the CSA builtins? I'll take a look

This is still broken on ToT, but I think I have a reasonable fix, will send that in a few minutes

ClusterFuzz has detected this issue as fixed in range 40975:40976.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5902916650270720

Fuzzer: v8_builtins_generator
Job Type: linux_asan_d8_v8_arm64_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  pc_->Mask(ExceptionMask) == HLT in simulator-arm64.cc
  
Regressed: V8: r40372:40373
Fixed: V8: r40975:40976

Minimized Testcase (0.09 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96lWj7gG3SOAPPLRjeZpmgHLRKOo7abWh5HHfTIR5hWDieEAz1kNd_bkqn-J8b32SW4zMWb-7c8tIvrRLemwomuc8LjmUkO2ybGO7TGAFMtUflehLXg0c5aPe1zPJdfViqPSI5bHOgGBLk7TutW7uBvWK7_HA?testcase_id=5902916650270720
 v1 = 0xFFFFFFFF; 
 v12 = new Array(v1); 
 v20 = v12.keys(); 
 v35 = new Uint8Array(v20); 


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot