Applying security view restrictions to all v8 CHECK/DCHECK failures.

(CHECKs aren't security, but we have no way to distinguish these right now).

The fix is on the way: https://chromium-review.googlesource.com/c/517087/

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/397afc696050690c6414a1e260d77cf17b577d36

commit 397afc696050690c6414a1e260d77cf17b577d36
Author: Igor Sheludko <ishell@chromium.org>
Date: Fri May 26 21:06:48 2017

[runtime] Set proper initial map for AsyncFunction constructor.

... to make AsyncFunction subclassing work.

Bug:  chromium:725537 
Change-Id: I7edf4891e14e01567046e7536b3aa93877111448
Reviewed-on: https://chromium-review.googlesource.com/517087
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45544}
[modify] https://crrev.com/397afc696050690c6414a1e260d77cf17b577d36/src/bootstrapper.cc
[add] https://crrev.com/397afc696050690c6414a1e260d77cf17b577d36/test/mjsunit/regress/regress-crbug-725537.js

ClusterFuzz has detected this issue as fixed in range 45543:45544.

Detailed report: https://clusterfuzz.com/testcase?key=6565040152117248

Fuzzer: inferno_js_fuzzer_c
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  map()->is_callable() in objects-debug.cc
  
Sanitizer: address (ASAN)

Regressed: V8: 37483:37484
Fixed: V8: 45543:45544

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6565040152117248


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot