Issue 726777  has been merged into this issue.

Bisects to 1979ab55fb920862bc6bc7d42e99cdb080589cfd.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/32e4bcd9748ff49503bed57bb9e8a9cba329c601

commit 32e4bcd9748ff49503bed57bb9e8a9cba329c601
Author: Camillo Bruni <cbruni@chromium.org>
Date: Tue May 30 14:05:34 2017

[heap-verify] Fix arguments verification with mapped elements

Bug:  chromium:726836 
Change-Id: I2eaec8550e7ba038646a1f7834d4514a8d4009ea
Reviewed-on: https://chromium-review.googlesource.com/517954
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45604}
[modify] https://crrev.com/32e4bcd9748ff49503bed57bb9e8a9cba329c601/src/objects-debug.cc
[modify] https://crrev.com/32e4bcd9748ff49503bed57bb9e8a9cba329c601/src/objects-printer.cc
[modify] https://crrev.com/32e4bcd9748ff49503bed57bb9e8a9cba329c601/test/mjsunit/arguments.js

ClusterFuzz has detected this issue as fixed in range 45603:45604.

Detailed report: https://clusterfuzz.com/testcase?key=6343749881036800

Fuzzer: inferno_js_fuzzer_c
Job Type: linux_asan_d8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  nofMappedParameters <= context_object->length() in objects-debug.cc
  
Sanitizer: address (ASAN)

Regressed: V8: 44701:44702
Fixed: V8: 45603:45604

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6343749881036800


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6343749881036800 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.