Reproduces locally, bisects to bbc89774a6cbacd021f44f65eb0ea0f79f17b8f9.
Clusterfuzz bisects differently (to 015edc60ff86b51a4bbf9ce11732ee5bb36245b2), but both are CLs by Camillo, so we have an owner :)

Detailed report: https://clusterfuzz.com/testcase?key=6598446651015168

Fuzzer: inferno_js_fuzzer
Job Type: linux_asan_d8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !field_type->NowStable() || field_type->NowContains(value) || (!FLAG_use_allocat
  v8::internal::JSObject::JSObjectVerify
  v8::internal::Object::ObjectVerify
  
Sanitizer: address (ASAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6598446651015168


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

let constant = { a: 1 }; 

function update_array(array) {
  print("array =======================================");
  %DebugPrint(array);
  print ("set -8.0 ===================================");
  array[-8.0] = constant;
  print("array after set -8 ==========================");
  %DebugPrint(array);
  %HeapObjectVerify(array);
  print("set 1 =======================================");
  array[0] = undefined;
  print("array =======================================");
  %DebugPrint(array);
  %HeapObjectVerify(array);
  return array; 
}

update_array([1]); 
constant = update_array([1]);
update_array([1]); 

This repro crashes before Camillo's CLs:

===== test.js =====

let constant = { a: 1 };

function update_array(array) {
  print("array =======================================");
  %DebugPrint(array);
  array.x = constant;
  %HeapObjectVerify(array);
  array[0] = undefined;
  print("array 2 =====================================");
  %DebugPrint(array);
  %HeapObjectVerify(array);
  return array;
}
%DebugPrint(update_array);

var ar1 = [1];
var ar2 = [2];
var ar3 = [3];
gc();
gc();
gc();

update_array(ar1);
constant = update_array(ar2);
update_array(ar3);

A friendly reminder that M61 branch is coming soon on 07/20! Your bug is labelled as Stable ReleaseBlock, pls make sure to land the fix ASAP to trunk. This way we branch M61 from a high quality trunk. Thank you.

The fix is on the way: https://chromium-review.googlesource.com/c/567992/

ClusterFuzz has detected this issue as fixed in range 46602:46603.

Detailed report: https://clusterfuzz.com/testcase?key=6342771542851584

Fuzzer: inferno_js_fuzzer
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !field_type->NowStable() || field_type->NowContains(value) || (!FLAG_use_allocat
  v8::internal::JSObject::JSObjectVerify
  v8::internal::Object::SetDataProperty
  
Sanitizer: address (ASAN)

Regressed: V8: 45974:45975
Fixed: V8: 46602:46603

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6342771542851584


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6342771542851584 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

The CL at #13 only hid the issue discovered by CF but the issue is still there.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/b90e83f5da40b214646327f8791834eeb5ddedd4

commit b90e83f5da40b214646327f8791834eeb5ddedd4
Author: Igor Sheludko <ishell@chromium.org>
Date: Thu Jul 13 09:16:56 2017

[runtime] Add shortcuts for elements kinds transitions.

The shortcuts ensure that field type generalization is properly
propagated in the transition graph.

Bug:  chromium:738763 
Change-Id: Id701a6f95ed6ea093c707fbe0bac228f1f856e9f
Reviewed-on: https://chromium-review.googlesource.com/567992
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46622}
[modify] https://crrev.com/b90e83f5da40b214646327f8791834eeb5ddedd4/src/heap-symbols.h
[modify] https://crrev.com/b90e83f5da40b214646327f8791834eeb5ddedd4/src/ic/ic.cc
[modify] https://crrev.com/b90e83f5da40b214646327f8791834eeb5ddedd4/src/map-updater.cc
[modify] https://crrev.com/b90e83f5da40b214646327f8791834eeb5ddedd4/src/objects-debug.cc
[modify] https://crrev.com/b90e83f5da40b214646327f8791834eeb5ddedd4/src/objects-inl.h
[modify] https://crrev.com/b90e83f5da40b214646327f8791834eeb5ddedd4/src/objects-printer.cc
[modify] https://crrev.com/b90e83f5da40b214646327f8791834eeb5ddedd4/src/objects.cc
[modify] https://crrev.com/b90e83f5da40b214646327f8791834eeb5ddedd4/src/objects.h
[modify] https://crrev.com/b90e83f5da40b214646327f8791834eeb5ddedd4/src/objects/map.h
[modify] https://crrev.com/b90e83f5da40b214646327f8791834eeb5ddedd4/src/transitions-inl.h
[modify] https://crrev.com/b90e83f5da40b214646327f8791834eeb5ddedd4/src/transitions.cc
[modify] https://crrev.com/b90e83f5da40b214646327f8791834eeb5ddedd4/src/transitions.h
[modify] https://crrev.com/b90e83f5da40b214646327f8791834eeb5ddedd4/test/cctest/test-field-type-tracking.cc
[add] https://crrev.com/b90e83f5da40b214646327f8791834eeb5ddedd4/test/mjsunit/regress/regress-crbug-738763.js

Ok, now it is fixed for real.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/682832a0f5587e98d165759ecc1e61066bad4544

commit 682832a0f5587e98d165759ecc1e61066bad4544
Author: Michael Achenbach <machenbach@chromium.org>
Date: Fri Jul 14 08:04:05 2017

Revert "[runtime] Add shortcuts for elements kinds transitions."

This reverts commit b90e83f5da40b214646327f8791834eeb5ddedd4.

Reason for revert: Blocks roll:
https://chromium-review.googlesource.com/c/570002/

Confirmed by:
https://chromium-review.googlesource.com/c/571700/2

Original change's description:
> [runtime] Add shortcuts for elements kinds transitions.
> 
> The shortcuts ensure that field type generalization is properly
> propagated in the transition graph.
> 
> Bug:  chromium:738763 
> Change-Id: Id701a6f95ed6ea093c707fbe0bac228f1f856e9f
> Reviewed-on: https://chromium-review.googlesource.com/567992
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46622}

TBR=jkummerow@chromium.org,ishell@chromium.org

Change-Id: I5ede80db6bc209f16c6fd43f6bf3c8865c9577d8
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  chromium:738763 
Reviewed-on: https://chromium-review.googlesource.com/571741
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46660}
[modify] https://crrev.com/682832a0f5587e98d165759ecc1e61066bad4544/src/heap-symbols.h
[modify] https://crrev.com/682832a0f5587e98d165759ecc1e61066bad4544/src/ic/ic.cc
[modify] https://crrev.com/682832a0f5587e98d165759ecc1e61066bad4544/src/map-updater.cc
[modify] https://crrev.com/682832a0f5587e98d165759ecc1e61066bad4544/src/objects-debug.cc
[modify] https://crrev.com/682832a0f5587e98d165759ecc1e61066bad4544/src/objects-inl.h
[modify] https://crrev.com/682832a0f5587e98d165759ecc1e61066bad4544/src/objects-printer.cc
[modify] https://crrev.com/682832a0f5587e98d165759ecc1e61066bad4544/src/objects.cc
[modify] https://crrev.com/682832a0f5587e98d165759ecc1e61066bad4544/src/objects.h
[modify] https://crrev.com/682832a0f5587e98d165759ecc1e61066bad4544/src/objects/map.h
[modify] https://crrev.com/682832a0f5587e98d165759ecc1e61066bad4544/src/transitions-inl.h
[modify] https://crrev.com/682832a0f5587e98d165759ecc1e61066bad4544/src/transitions.cc
[modify] https://crrev.com/682832a0f5587e98d165759ecc1e61066bad4544/src/transitions.h
[modify] https://crrev.com/682832a0f5587e98d165759ecc1e61066bad4544/test/cctest/test-field-type-tracking.cc
[delete] https://crrev.com/db3d4388f8fbe349302829c64c12b89071629582/test/mjsunit/regress/regress-crbug-738763.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/6e27386d68eb737b98d37cb32e14d6bea1fd62cd

commit 6e27386d68eb737b98d37cb32e14d6bea1fd62cd
Author: Igor Sheludko <ishell@chromium.org>
Date: Wed Jul 19 11:31:21 2017

Reland "[runtime] Add shortcuts for elements kinds transitions."

This is a reland of b90e83f5da40b214646327f8791834eeb5ddedd4
Original change's description:
> [runtime] Add shortcuts for elements kinds transitions.
>
> The shortcuts ensure that field type generalization is properly
> propagated in the transition graph.
>
> Bug:  chromium:738763 
> Change-Id: Id701a6f95ed6ea093c707fbe0bac228f1f856e9f
> Reviewed-on: https://chromium-review.googlesource.com/567992
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46622}

Bug:  chromium:738763 ,  chromium:742346 ,  chromium:742381 ,  chromium:745844 
Change-Id: I93974e3906b2c7710bd525f15037a2dd97f263ad
Reviewed-on: https://chromium-review.googlesource.com/575227
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46759}
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/heap-symbols.h
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/heap/mark-compact.cc
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/ic/ic.cc
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/map-updater.cc
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/objects-debug.cc
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/objects-inl.h
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/objects-printer.cc
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/objects.cc
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/objects.h
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/objects/map.h
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/transitions-inl.h
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/transitions.cc
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/transitions.h
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/test/cctest/test-field-type-tracking.cc
[add] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/test/mjsunit/regress/regress-crbug-738763.js
[add] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/test/mjsunit/regress/regress-crbug-742346.js
[add] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/test/mjsunit/regress/regress-crbug-742381.js

Please merge the reland to 6.1 as it missed the branch gut.

Pls merge your change to M61 branch by 5:00 PM PT, Monday (07/24) so we can it in for next week M61 dev release. Thank you.

Pls merge your change to M61 branch 3163 by 5:00 PM PT, Monday (07/24) so we can take it in for next week M61 dev release. Thank you.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/5520cae3fd599cb77b4b9c744b07548459655ee3

commit 5520cae3fd599cb77b4b9c744b07548459655ee3
Author: Igor Sheludko <ishell@chromium.org>
Date: Mon Jul 24 05:31:29 2017

Revert "Reland "[runtime] Add shortcuts for elements kinds transitions.""

This reverts commit 6e27386d68eb737b98d37cb32e14d6bea1fd62cd.

Reason for revert: There will be another much simpler and
back-mergeable fix.

Original change's description:
> Reland "[runtime] Add shortcuts for elements kinds transitions."
> 
> This is a reland of b90e83f5da40b214646327f8791834eeb5ddedd4
> Original change's description:
> > [runtime] Add shortcuts for elements kinds transitions.
> >
> > The shortcuts ensure that field type generalization is properly
> > propagated in the transition graph.
> >
> > Bug:  chromium:738763 
> > Change-Id: Id701a6f95ed6ea093c707fbe0bac228f1f856e9f
> > Reviewed-on: https://chromium-review.googlesource.com/567992
> > Commit-Queue: Igor Sheludko <ishell@chromium.org>
> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#46622}
> 
> Bug:  chromium:738763 ,  chromium:742346 ,  chromium:742381 ,  chromium:745844 
> Change-Id: I93974e3906b2c7710bd525f15037a2dd97f263ad
> Reviewed-on: https://chromium-review.googlesource.com/575227
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46759}

TBR=ulan@chromium.org,jkummerow@chromium.org,ishell@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug:  chromium:738763 ,  chromium:742346 ,  chromium:742381 ,  chromium:745844 
Change-Id: I203dc748c47db554e0a86d61f0e2b7b8b96f2370
Reviewed-on: https://chromium-review.googlesource.com/581547
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46826}
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/heap-symbols.h
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/heap/mark-compact.cc
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/ic/ic.cc
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/map-updater.cc
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/objects-debug.cc
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/objects-inl.h
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/objects-printer.cc
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/objects.cc
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/objects.h
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/objects/map.h
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/transitions-inl.h
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/transitions.cc
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/transitions.h
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/test/cctest/test-field-type-tracking.cc
[delete] https://crrev.com/b1f0e653f48afe9e9d378a3d97c70f9a03582a78/test/mjsunit/regress/regress-crbug-738763.js
[delete] https://crrev.com/b1f0e653f48afe9e9d378a3d97c70f9a03582a78/test/mjsunit/regress/regress-crbug-742346.js
[delete] https://crrev.com/b1f0e653f48afe9e9d378a3d97c70f9a03582a78/test/mjsunit/regress/regress-crbug-742381.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/21e7f083851e211cb2af062371d5e3656ec5f38a

commit 21e7f083851e211cb2af062371d5e3656ec5f38a
Author: Igor Sheludko <ishell@chromium.org>
Date: Mon Jul 24 06:34:12 2017

[runtime] Don't track "class" field types for arrays with properties.

... in order to avoid the need to update field types through elements
kind transitions.

Bug:  chromium:738763 ,  chromium:745844 
Change-Id: I9f0e7f321e7f44ab5b36c06dd4c5633611370807
Reviewed-on: https://chromium-review.googlesource.com/581647
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46830}
[modify] https://crrev.com/21e7f083851e211cb2af062371d5e3656ec5f38a/src/objects.cc
[modify] https://crrev.com/21e7f083851e211cb2af062371d5e3656ec5f38a/src/objects.h
[modify] https://crrev.com/21e7f083851e211cb2af062371d5e3656ec5f38a/src/objects/map.h
[modify] https://crrev.com/21e7f083851e211cb2af062371d5e3656ec5f38a/test/cctest/test-field-type-tracking.cc
[add] https://crrev.com/21e7f083851e211cb2af062371d5e3656ec5f38a/test/mjsunit/regress/regress-crbug-738763.js

This bug requires manual review: We are only 0 days from stable.
Please contact the milestone owner if you have questions.
Owners: amineer@(Android), cmasso@(iOS), josafat@(ChromeOS), bustamante@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug requires manual review: We are only 0 days from stable.
Please contact the milestone owner if you have questions.
Owners: amineer@(Android), cmasso@(iOS), josafat@(ChromeOS), bustamante@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Pls merge your change to M61 branch 3163 by 5:00 PM PT today, Monday so we can take it in for this week M61 dev release. Thank you.

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/c558369af2f4a53d4b9fdff9534fdc202f27c098

commit c558369af2f4a53d4b9fdff9534fdc202f27c098
Author: Igor Sheludko <ishell@chromium.org>
Date: Tue Jul 25 06:54:46 2017

[runtime] Don't create "class" field types for arrays' fields.

... when reconfiguring const fields to mutable fields.

Bug:  chromium:747979 ,  chromium:738763 ,  chromium:745844 
Change-Id: Ibfac1b875a1da8234966ac10658260f1cc718fe5
Reviewed-on: https://chromium-review.googlesource.com/583647
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46854}
[modify] https://crrev.com/c558369af2f4a53d4b9fdff9534fdc202f27c098/src/map-updater.cc
[modify] https://crrev.com/c558369af2f4a53d4b9fdff9534fdc202f27c098/src/objects-debug.cc
[add] https://crrev.com/c558369af2f4a53d4b9fdff9534fdc202f27c098/test/mjsunit/regress/regress-crbug-747979.js

Please merge your change to M61 branch #3163 before 4: 00 PM PT, Wednesday (07/26) in order to make it to last M61 dev release. Thank you.

Pls merge you change to M61 branch 3163 by 5:00 PM today, Wednesday if possible so we can take it in for next week M61 last dev release. Thank you.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/10e4fe3d32c5ca205948ca44f4f2b9edd50b7755

commit 10e4fe3d32c5ca205948ca44f4f2b9edd50b7755
Author: Igor Sheludko <ishell@chromium.org>
Date: Thu Jul 27 07:11:05 2017

[runtime] Don't create class field types for arrays' fields.

... when generalizing const fields to mutable fields.

Bug:  chromium:748539 ,  chromium:747979 ,  chromium:738763 
Change-Id: Iee772a5d0cddd23599f1f68bca00b8beecb76da0
Reviewed-on: https://chromium-review.googlesource.com/586709
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46921}
[modify] https://crrev.com/10e4fe3d32c5ca205948ca44f4f2b9edd50b7755/src/map-updater.cc
[modify] https://crrev.com/10e4fe3d32c5ca205948ca44f4f2b9edd50b7755/src/map-updater.h
[modify] https://crrev.com/10e4fe3d32c5ca205948ca44f4f2b9edd50b7755/src/objects.cc
[modify] https://crrev.com/10e4fe3d32c5ca205948ca44f4f2b9edd50b7755/src/objects/map-inl.h
[modify] https://crrev.com/10e4fe3d32c5ca205948ca44f4f2b9edd50b7755/src/objects/map.h
[add] https://crrev.com/10e4fe3d32c5ca205948ca44f4f2b9edd50b7755/test/mjsunit/regress/regress-crbug-748539.js

CF still finds issues. Hopefully the #35 is the last missing piece. I'll merge all three fixes at once when we have a Canary coverage for them.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6

commit b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6
Author: ishell@chromium.org <ishell@chromium.org>
Date: Fri Jul 28 09:33:02 2017

Merged: Squashed multiple commits.

Merged: [runtime] Don't track "class" field types for arrays with properties.
Revision: 21e7f083851e211cb2af062371d5e3656ec5f38a

Merged: [runtime] Don't create "class" field types for arrays' fields.
Revision: c558369af2f4a53d4b9fdff9534fdc202f27c098

Merged: [runtime] Don't create class field types for arrays' fields.
Revision: 10e4fe3d32c5ca205948ca44f4f2b9edd50b7755

BUG= chromium:738763 , chromium:745844 , chromium:747979 , chromium:748539 
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=hablich@chromium.org

Change-Id: I73e305aacfb532121f1621078a46f465cf463b05
Reviewed-on: https://chromium-review.googlesource.com/590230
Reviewed-by: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.1@{#22}
Cr-Branched-From: 1bf2e10ddb194d4c2871a87a4732613419de892d-refs/heads/6.1.534@{#1}
Cr-Branched-From: e825c4318eb2065ffdf9044aa6a5278635c36427-refs/heads/master@{#46746}
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/src/map-updater.cc
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/src/map-updater.h
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/src/objects-debug.cc
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/src/objects.cc
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/src/objects.h
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/src/objects/map-inl.h
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/src/objects/map.h
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/test/cctest/test-field-type-tracking.cc
[add] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/test/mjsunit/regress/regress-crbug-738763.js
[add] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/test/mjsunit/regress/regress-crbug-747979.js
[add] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/test/mjsunit/regress/regress-crbug-748539.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/02d47a027fac8057e7e3923ad1d488ecad3a5381

commit 02d47a027fac8057e7e3923ad1d488ecad3a5381
Author: ishell@chromium.org <ishell@chromium.org>
Date: Fri Jul 28 11:25:20 2017

Merged: Squashed multiple commits.

Merged: [runtime] Don't track "class" field types for arrays with properties.
Revision: 21e7f083851e211cb2af062371d5e3656ec5f38a

Merged: [runtime] Don't create "class" field types for arrays' fields.
Revision: c558369af2f4a53d4b9fdff9534fdc202f27c098

Merged: [runtime] Don't create class field types for arrays' fields.
Revision: 10e4fe3d32c5ca205948ca44f4f2b9edd50b7755

BUG= chromium:738763 , chromium:745844 , chromium:747979 , chromium:748539 
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=hablich@chromium.org

Change-Id: I4e3b4717aca1516aa3b531afd23313f6c24cb4c4
Reviewed-on: https://chromium-review.googlesource.com/590232
Reviewed-by: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.0@{#99}
Cr-Branched-From: 97dbf624a5eeffb3a8df36d24cdb2a883137385f-refs/heads/6.0.286@{#1}
Cr-Branched-From: 12e6f1cb5cd9616da7b9d4a7655c088778a6d415-refs/heads/master@{#45439}
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/src/map-updater.cc
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/src/map-updater.h
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/src/objects-debug.cc
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/src/objects.cc
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/src/objects.h
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/src/objects/map-inl.h
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/src/objects/map.h
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/test/cctest/test-field-type-tracking.cc
[add] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/test/mjsunit/regress/regress-crbug-738763.js
[add] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/test/mjsunit/regress/regress-crbug-747979.js
[add] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/test/mjsunit/regress/regress-crbug-748539.js

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

It's already merged to M60.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot