This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Assigning to current v8 CF sheriff.

 Issue 727406  has been merged into this issue.

Bisect seems reasonable (804ac5f6189621f7ba47e5af569f8aa7abd3c84f), assigning to Marja.

Afaics this is related to --experimental-preparser-scope-analysis which we're not shipping atm.

But I cannot find the command line in the report to verify that this flag is actually passed.

In addition, I was told clusterfuzz doesn't fuzz with --experimental flags, so, now I'm confused!

Ah, the command line was one click away :)

--experimental-preparser-scope-analysis stuff. Not a blocker or a security risk at the moment. Will fix before shipping the flag.

(Is it OK to just remove the security flags?)

ClusterFuzz has detected this issue as fixed in range 46133:46134.

Detailed report: https://clusterfuzz.com/testcase?key=6396884716617728

Fuzzer: inferno_js_fuzzer
Job Type: linux_asan_d8_v8_mipsel_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  data.num_parameters == scope->num_parameters() in preparsed-scope-data.cc
  v8::internal::PreParsedScopeData::RestoreData
  v8::internal::PreParsedScopeData::RestoreDataForInnerScopes
  
Sanitizer: address (ASAN)

Regressed: V8: 45565:45566
Fixed: V8: 46133:46134

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6396884716617728


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5811155867271168 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot