Fix in https://chromium-review.googlesource.com/c/528275/https://chromium-review.googlesource.com/c/528275/

Actual URL is: https://chromium-review.googlesource.com/c/528275/

This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/fc826e3735b2e1455d0f5c4df01ec3a3e68ad14b

commit fc826e3735b2e1455d0f5c4df01ec3a3e68ad14b
Author: Ross McIlroy <rmcilroy@chromium.org>
Date: Fri Jun 09 15:10:56 2017

[TurboFan] Fix typing of INTERNALIZED_STRING_TYPE for new EmptyString type.

Add kInternalizedNonEmptySeqString and make kInternalizedString = 
kEmptyString | kInternalizedNonEmptySeqString.

BUG= chromium:731495 

Change-Id: I60a6f37242423407ad97188b3f4bd48ae6989ad2
Reviewed-on: https://chromium-review.googlesource.com/528275
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45821}
[modify] https://crrev.com/fc826e3735b2e1455d0f5c4df01ec3a3e68ad14b/src/compiler/types.h
[add] https://crrev.com/fc826e3735b2e1455d0f5c4df01ec3a3e68ad14b/test/mjsunit/compiler/regress-731495.js

ClusterFuzz has detected this issue as fixed in range 45820:45821.

Detailed report: https://clusterfuzz.com/testcase?key=6566246584942592

Fuzzer: inferno_js_fuzzer
Job Type: linux_asan_d8_v8_mipsel_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  args[0]->IsString() in runtime-strings.cc
  v8::internal::__RT_impl_Runtime_StringAdd
  v8::internal::Runtime_StringAdd
  
Sanitizer: address (ASAN)

Regressed: V8: 45785:45786
Fixed: V8: 45820:45821

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6566246584942592


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug requires manual review: M60 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: amineer@(Android), cmasso@(iOS), josafat@(ChromeOS), bustamante@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Approving merge to M60. Security bug marked as RB-Stable. 

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The CL which introduced the bug was never in the m60 branch, so no need to merge.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot