Regression range points to 0d06e42b690cfe80454c7f065c382f2b7200a40f (might have just flushed out the problem though). Reproduces on 32-bit architectures (I tried on ia32.debug and arm.debug, no ASAN required). Run the repro as follows to reproduce ...

$ ./out/ia32.debug/d8 ~/Downloads/clusterfuzz-testcase-minimized-6309710805598208.js --expose-gc --enable-slow-asserts

Thanks, will take a look.

This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/21389501f56789cb414329d5c6cb9a7ffd94f8e3

commit 21389501f56789cb414329d5c6cb9a7ffd94f8e3
Author: Michael Lippautz <mlippautz@chromium.org>
Date: Wed Jun 14 15:18:01 2017

[heap] Fix adjusting of area end when shrinking large pages

Bug:  chromium:733059 ,  chromium:724947 
Change-Id: Id7abc22ee0975cd609cc06a02552f68e9e0077e8
Reviewed-on: https://chromium-review.googlesource.com/535596
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45952}
[modify] https://crrev.com/21389501f56789cb414329d5c6cb9a7ffd94f8e3/src/heap/spaces.cc
[modify] https://crrev.com/21389501f56789cb414329d5c6cb9a7ffd94f8e3/src/heap/spaces.h
[add] https://crrev.com/21389501f56789cb414329d5c6cb9a7ffd94f8e3/test/mjsunit/regress/regress-733059.js

ClusterFuzz has detected this issue as fixed in range 45951:45952.

Detailed report: https://clusterfuzz.com/testcase?key=6309710805598208

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !v8::internal::FLAG_enable_slow_asserts || (!owned || FindObject(address)->IsHea
  v8::internal::LargeObjectSpace::Contains
  v8::internal::Heap::Contains
  
Sanitizer: address (ASAN)

Regressed: V8: 45646:45647
Fixed: V8: 45951:45952

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6309710805598208


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot