CF points to 439a8edcf77947777c5c757b0dec0363d9446093.

This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

[builtins] fix String.prototype.indexOf with negative indices

BUG= 689078 

Review-Url: https://codereview.chromium.org/2679173002
Cr-Commit-Position: refs/heads/master@{#43016}
Committed: https://chromium.googlesource.com/v8/v8/+/029a145fdb35061c0a1ae413532ca9dc62f4cce2

ClusterFuzz has detected this issue as fixed in range 43015:43016.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5006028967247872

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x7f3e84e30270
Crash State:
  memchr
  v8::internal::Invoke
  v8::internal::CallInternal
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: V8: 42694:42695
Fixed: V8: 43015:43016

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94Wb21Di7Fqtz1BhDB8EzpSw1d1yGB9PHyF35a02bJObxlktf6RX1QTg6KBgDgBzvGsowh996epNfIubfa6F7c04JOA3kAqcZoiIX9Wgl9pq4XgHWSCSwUh0LjR2G1D8w3guw6dD13J6WQ-Fsu7XwHJOPLP0Or7FxQI5e2ijLGbImbtrLBLXfWWbwMDuwpgZelqQQ2bwVFAIBARmYkIHRNEiYKxVtJq1em8IpGalhMbuNDJNG4VgdnMZyXLVcp8orCYTck3pDwHtCV0wRWGsMfMBiuuiJwCN6IHNP1TfZioZoUZwQDdS1mcS1dD8a1dULSTItn4w5At4q0Q7IImIAwarBtfiNb6PEBYMBXaHpdNXwXw2yt8LkOhDw1S5YCdi03aE2DVNfjQbBqWQhMFLCszZzvEKQ?testcase_id=5006028967247872


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot