This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Regression from https://chromium.googlesource.com/v8/v8.git/+/a209dcf6a151b0bc26aace1b49507af255b948b2

This is very unlikely related to my change, as the example does not involve modules. mstarzinger kindly offered to bisect further.

I can reproduce and hit a CSA-assert. Will bisect.

Reduced repro ...

<title id=tCF1></title>
    <script>
tCF1.childNodes.values(0);
</script>

Finally, a d8-only repro ...

$ ./out/x64.debug/d8 -e 'Array.prototype[Symbol.iterator](0)'

Bisects to bb70859f01199ad7ac4f38309863a90adf5a0df7. The following shows that the formal parameter counts indicates that arguments should not be adapted.

Before the CL:
~/Development/v8.git$ ./out/x64.debug/d8 -e '%DebugPrint(Array.prototype[Symbol.iterator])' --allow-natives-syntax
DebugPrint: 0x856edd884e1: [Function]
 - map = 0x171d26a02a41 [FastProperties]
 - prototype = 0x856edd845f9
 - elements = 0x10a7e5402241 <FixedArray[0]> [FAST_HOLEY_ELEMENTS]
 - initial_map = 
 - shared_info = 0x10a7e544dc91 <SharedFunctionInfo values>
 - name = 0x10a7e54042a9 <String[6]: values>
 - formal_parameter_count = 0
 - kind = [ NormalFunction ]
 - context = 0x856edd83d91 <FixedArray[267]>
 - feedback vector cell = 0x10a7e5402811 <Cell value= 0x10a7e5402311 <undefined>>
 - code = 0xa55b8ef6621 <Code BUILTIN>
 - properties = 0x10a7e5402241 <FixedArray[0]> {
    #length: 0x10a7e54605b1 <AccessorInfo> (const accessor descriptor)
    #name: 0x10a7e5460621 <AccessorInfo> (const accessor descriptor)
 }

After the CL:
~/Development/v8.git$ ./out/x64.debug/d8 -e '%DebugPrint(Array.prototype[Symbol.iterator])' --allow-natives-syntax
DebugPrint: 0x2a03b507a29: [Function]
 - map = 0x38a610e82a41 [FastProperties]
 - prototype = 0x2a03b5045f9
 - elements = 0x174bdfa82241 <FixedArray[0]> [FAST_HOLEY_ELEMENTS]
 - initial_map = 
 - shared_info = 0x174bdfaaeae9 <SharedFunctionInfo values>
 - name = 0x174bdfa842a9 <String[6]: values>
 - formal_parameter_count = -1
 - kind = [ NormalFunction ]
 - context = 0x2a03b503d91 <FixedArray[267]>
 - feedback vector cell = 0x174bdfa82811 <Cell value= 0x174bdfa82311 <undefined>>
 - code = 0x3f39c4169fc1 <Code BUILTIN>
 - properties = 0x174bdfa82241 <FixedArray[0]> {
    #length: 0x174bdfae10f1 <AccessorInfo> (const accessor descriptor)
    #name: 0x174bdfae1161 <AccessorInfo> (const accessor descriptor)
 }

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/46a5d96bf74d648e84d92f2e1cfff788e522503b

commit 46a5d96bf74d648e84d92f2e1cfff788e522503b
Author: Igor Sheludko <ishell@chromium.org>
Date: Fri Jun 30 14:28:54 2017

[runtime] Fix broken definition of Array.prototype[@@iterator].

...and cleanup definition of several builtins in %TypedArrayPrototype%.

Bug: v8:6459,  chromium:737877 
Change-Id: Ic5832847476bf5a544ae0b0df5df0ed4edd3e44c
Reviewed-on: https://chromium-review.googlesource.com/558076
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46365}
[modify] https://crrev.com/46a5d96bf74d648e84d92f2e1cfff788e522503b/src/bootstrapper.cc

ClusterFuzz has detected this issue as fixed in range 483802:483834.

Detailed report: https://clusterfuzz.com/testcase?key=5745592377802752

Fuzzer: inferno_twister
Job Type: windows_asan_chrome
Platform Id: windows

Crash Type: UNKNOWN
Crash Address: 0x12ef04c5
Crash State:
  v8::internal::Invoke
  v8::internal::Execution::Call
  v8::Script::Run
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome&range=483124:483186
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_chrome&range=483802:483834

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5745592377802752


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot