This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

CF points to I+TF launch CL (0f716acadaed1d9e194593543dbe1340d600d6fc).

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/bdf1b0a84ae4ce3f76b5deb86a63e1c5f7fc2b90

commit bdf1b0a84ae4ce3f76b5deb86a63e1c5f7fc2b90
Author: jarin <jarin@chromium.org>
Date: Mon Jun 26 13:49:06 2017

[turbofan] Fix an assertion in representation selection for BooleanNot.

BUG= chromium:736567 

Review-Url: https://codereview.chromium.org/2962503002
Cr-Commit-Position: refs/heads/master@{#46216}

[modify] https://crrev.com/bdf1b0a84ae4ce3f76b5deb86a63e1c5f7fc2b90/src/compiler/simplified-lowering.cc
[add] https://crrev.com/bdf1b0a84ae4ce3f76b5deb86a63e1c5f7fc2b90/test/mjsunit/compiler/regress-736567.js

ClusterFuzz has detected this issue as fixed in range 46215:46216.

Detailed report: https://clusterfuzz.com/testcase?key=6524358532268032

Fuzzer: inferno_js_fuzzer
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  MachineRepresentation::kNone == input_info->representation() in simplified-lower
  v8::internal::compiler::RepresentationSelector::VisitNode
  v8::internal::compiler::RepresentationSelector::Run
  
Sanitizer: address (ASAN)

Regressed: V8: 43683:43684
Fixed: V8: 46215:46216

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6524358532268032


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot