Regression range points to 5b427ad2d1e2c21a1a2ffafeaebb1593c70fc5b5. Extracted repro is ...

function boom() {
  var args = [];
  for (var i = 0; i < 125000; i++)
    args.push(140737220444159, 524287);
  return Array.apply(Array, args);
}
var array = boom();

 Issue 733132  has been merged into this issue.

This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Fix is in flight

Reducing severity, this is not exploitable as far as I can tell.

Detailed report: https://clusterfuzz.com/testcase?key=5394296642732032

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  size <= kMaxRegularHeapObjectSize in runtime-internal.cc
  __RT_impl_Runtime_AllocateInNewSpace
  v8::internal::Runtime_AllocateInNewSpace
  
Sanitizer: address (ASAN)

Regressed: V8: 45896:45897

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5394296642732032


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Looks like regular check failure hard crash, removing from security queue.

Removing the blocker label as this is P2 and no longer in security queue. Feel free to add it back if someone feels otherwise.

ClusterFuzz has detected this issue as fixed in range 45998:45999.

Detailed report: https://clusterfuzz.com/testcase?key=6566713058656256

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  size <= kMaxRegularHeapObjectSize in runtime-internal.cc
  v8::internal::__RT_impl_Runtime_AllocateInNewSpace
  v8::internal::Runtime_AllocateInNewSpace
  
Sanitizer: address (ASAN)

Regressed: V8: 45896:45897
Fixed: V8: 45998:45999

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6566713058656256


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 45998:45999.

Detailed report: https://clusterfuzz.com/testcase?key=5394296642732032

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  size <= kMaxRegularHeapObjectSize in runtime-internal.cc
  __RT_impl_Runtime_AllocateInNewSpace
  v8::internal::Runtime_AllocateInNewSpace
  
Sanitizer: address (ASAN)

Regressed: V8: 45896:45897
Fixed: V8: 45998:45999

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5394296642732032


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

 Issue 735277  has been merged into this issue.