The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/1f51f66f738a05b5f0181e7e37ab171b6f112bac

commit 1f51f66f738a05b5f0181e7e37ab171b6f112bac
Author: jkummerow <jkummerow@chromium.org>
Date: Thu May 04 13:41:08 2017

Fix FastAssign for self-assignment

Storing a data property on |target| can change |source|'s map
if |target| and |source| are the same object.

BUG= chromium:716520 

Review-Url: https://codereview.chromium.org/2855133006
Cr-Commit-Position: refs/heads/master@{#45097}

[modify] https://crrev.com/1f51f66f738a05b5f0181e7e37ab171b6f112bac/src/objects.cc
[add] https://crrev.com/1f51f66f738a05b5f0181e7e37ab171b6f112bac/test/mjsunit/regress/regress-crbug-716520.js

The bug is old enough to deserve backmerging, but this probably doesn't happen much in the wild -- assigning an object to itself is usually a silly thing to do.

ClusterFuzz has detected this issue as fixed in range 469615:469622.

Detailed report: https://clusterfuzz.com/testcase?key=5205195098423296

Fuzzer: mbarbella_js_mutation
Job Type: windows_asan_d8
Platform Id: windows

Crash Type: UNKNOWN READ
Crash Address: 0x00000003
Crash State:
  v8::internal::JSObject::FastPropertyAt
  v8::internal::JSReceiver::SetOrCopyDataProperties
  v8::internal::Builtin_Impl_ObjectAssign
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_d8&range=429243:429247
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_d8&range=469615:469622

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5205195098423296


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.