Reproduces in d8, local bisect isolates 3a80814d53ab706b61e5a862692a053b0bb04103.

Camillo, can you take a look please?

Looks security relevant, adding the respective labels.

This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This is merely a verification issue, since I forgot about constant tracking, fix on the way.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/66fe2d496d4f644cb20bdc8e5ceeae5b78776fbb

commit 66fe2d496d4f644cb20bdc8e5ceeae5b78776fbb
Author: Camillo Bruni <cbruni@chromium.org>
Date: Wed Jun 14 07:19:20 2017

[heap-verify] Relax arguments verification

For unknown Argument object Maps we have to expect that constants fields
are kept on the Map.

Bug:  chromium:729597 
Change-Id: I110f77455ce434a431c8de27d021b1a5deb86f30
Reviewed-on: https://chromium-review.googlesource.com/532900
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45935}
[modify] https://crrev.com/66fe2d496d4f644cb20bdc8e5ceeae5b78776fbb/src/objects-debug.cc
[add] https://crrev.com/66fe2d496d4f644cb20bdc8e5ceeae5b78776fbb/test/mjsunit/regress/regress-crbug-729597.js

ClusterFuzz has detected this issue as fixed in range 479385:479423.

Detailed report: https://clusterfuzz.com/testcase?key=4921300048150528

Fuzzer: mbarbella_js_mutation
Job Type: mac_asan_d8
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x000000000038
Crash State:
  heap
  GetHeap
  VerifyHeapPointer
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_d8&range=471691:471787
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_d8&range=479385:479423

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4921300048150528


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 479385:479423.

Detailed report: https://clusterfuzz.com/testcase?key=4921300048150528

Fuzzer: mbarbella_js_mutation
Job Type: mac_asan_d8
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x000000000038
Crash State:
  heap
  GetHeap
  VerifyHeapPointer
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_d8&range=471691:471787
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_d8&range=479385:479423

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4921300048150528


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug requires manual review: M60 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: amineer@(Android), cmasso@(iOS), josafat@(ChromeOS), bustamante@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

+awhalley does this need to be merge for M60?

As per comment #7 this is not required.

ok thanks!

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot