This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Reproduces locally without any further flags.
Minimized test case is most simple:
 eval(`class C { ...[] }`);

Bisect points to b354204253b134682f4b810780abbc1dee7aba37 (https://chromium-review.googlesource.com/486245).

Seems to be fixed on ToT, however.
Sathya, can you confirm that this was fixed already?

 Issue 717836  has been merged into this issue.

ClusterFuzz has detected this issue as fixed in range 468912:468977.

Detailed report: https://clusterfuzz.com/testcase?key=5403560232878080

Fuzzer: mbarbella_js_mutation
Job Type: mac_asan_d8
Platform Id: mac

Crash Type: Ill
Crash Address: 0x000106fcc7e8
Crash State:
  v8::internal::ParserBase<v8::internal::Parser>::ParseClassPropertyDefinition
  v8::internal::ParserBase<v8::internal::Parser>::ParseClassLiteral
  v8::internal::ParserBase<v8::internal::Parser>::ParseClassDeclaration
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_d8&range=467314:467323
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_d8&range=468912:468977

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5403560232878080


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5403560232878080 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot