// Range error. Repro:
new Uint8ClampedArray().set({}, 1073741824);

// Only in ia32:
./repro.js:1: RangeError: Source is too large
new Uint8ClampedArray().set({}, 1073741824);
                        ^

// The minimized test case from clusterfuzz swallows the exception so that the range error suppression doesn't match.

Actually, I could override Uint8ClampedArray().set in the respective typed array mocks for this.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/9b5042575c944114ed90adf781c25814c87081ca

commit 9b5042575c944114ed90adf781c25814c87081ca
Author: Michael Achenbach <machenbach@chromium.org>
Date: Fri Jun 02 13:57:55 2017

[foozzie] Mock out typed array set function to suppress range error

NOTRY=true

Bug:  chromium:728867 
Change-Id: Ie116021aab9d72d01e1532036cb5de8f4b2bd2ab
Reviewed-on: https://chromium-review.googlesource.com/522663
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45689}
[modify] https://crrev.com/9b5042575c944114ed90adf781c25814c87081ca/tools/foozzie/v8_mock_archs.js

ClusterFuzz has detected this issue as fixed in range 45688:45689.

Detailed report: https://clusterfuzz.com/testcase?key=4706127018459136

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition:ia32,ignition
  sources: fda
  
Sanitizer: address (ASAN)

Fixed: V8: 45688:45689

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4706127018459136


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.