The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/f718cd1309be2327d1d218560f8663f8b165e4fa

commit f718cd1309be2327d1d218560f8663f8b165e4fa
Author: ishell <ishell@chromium.org>
Date: Wed Nov 16 17:44:39 2016

[ic] Invalidate prototype validity cell when a slow prototype becomes fast.

BUG= chromium:665886 

Review-Url: https://codereview.chromium.org/2502393002
Cr-Commit-Position: refs/heads/master@{#41045}

[modify] https://crrev.com/f718cd1309be2327d1d218560f8663f8b165e4fa/src/factory.cc
[modify] https://crrev.com/f718cd1309be2327d1d218560f8663f8b165e4fa/src/objects.cc
[modify] https://crrev.com/f718cd1309be2327d1d218560f8663f8b165e4fa/src/objects.h
[add] https://crrev.com/f718cd1309be2327d1d218560f8663f8b165e4fa/test/mjsunit/regress/regress-crbug-665886.js

ClusterFuzz has detected this issue as fixed in range 41044:41045.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6013610959831040

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_arm64_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  pc_->Mask(ExceptionMask) == HLT in simulator-arm64.cc
  
Regressed: V8: r40672:40673
Fixed: V8: r41044:41045

Minimized Testcase (0.65 Kb): https://cluster-fuzz.appspot.com/download/AMIfv974QhOKAy4-p3K5kdisqYJ4JVMfFMBKGoDKz7y_SBh1UgacLl5ueWaWVbh-E-bbzVkYMWR3L5lyELAngGU5F-DjlIOF6U3iBCRTV8JdSlXDRAeEdceXV1bSNKHYVgqsTRQc1mp1lEoLhHHOWR8izU6khbPETQ?testcase_id=6013610959831040

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

[Automated comment] Commit may have occurred before M56 branch point (11/17/2016), needs manual review.

The fix (#41045) landed after the branch point (#41014). We have to merge it.

M56 Beta promotion is scheduled on Dec 6 & RC cut on Monday, Dec 5 @ 4.00 PM PST.
Please merge your change ASAP so that we could take it for next Release.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/8feaaa256e6e36aad210467d808001bc26471e98

commit 8feaaa256e6e36aad210467d808001bc26471e98
Author: ishell@chromium.org <ishell@chromium.org>
Date: Mon Dec 05 12:47:56 2016

Merged: Squashed multiple commits.

Merged: [ic] Invalidate prototype validity cell when a slow prototype becomes fast.
Revision: f718cd1309be2327d1d218560f8663f8b165e4fa

Merged: [ic] Don't check full prototype chain if name is a private symbol.
Revision: 4513532f6362353eaf50ec30d753a346e795b164

BUG= chromium:664802 , chromium:664974 , chromium:665886 ,v8:5561
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/2554503002 .

Cr-Commit-Position: refs/branch-heads/5.6@{#32}
Cr-Branched-From: bdd3886218dfe76e8560eb8a18401942452ae859-refs/heads/5.6.326@{#1}
Cr-Branched-From: 879f6599eee6e1dfcbe9a24bf688b261c03e9558-refs/heads/master@{#41014}

[modify] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/src/factory.cc
[modify] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/src/ic/ic.cc
[modify] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/src/objects.cc
[modify] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/src/objects.h
[modify] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/src/prototype.h
[add] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/test/mjsunit/regress/regress-crbug-664802.js
[add] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/test/mjsunit/regress/regress-crbug-664974.js
[add] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/test/mjsunit/regress/regress-crbug-665886.js

-Merge-Review-56 as this was already merged