Bisects to f6d1dc40c8ecf852d1b1ac158ddd851bb031d03e. Reproduces nicely, in debug mode it fires an assert when assuming a stable map ...

$ ./out/x64.debug/d8 ~/Downloads/clusterfuzz-testcase-minimized-5013610563895296.JS 

#
# Fatal error in ../src/compilation-dependencies.cc, line 118
# Check failed: map->is_stable().
#

Does this have security implication, if yes, please change to Type-Bug-Security

Detailed report: https://clusterfuzz.com/testcase?key=5071770997751808

Fuzzer: inferno_js_fuzzer
Job Type: windows_asan_d8
Platform Id: windows

Crash Type: CHECK failure
Crash Address: 
Crash State:
  dependent_code()->IsEmpty(DependentCode::kPrototypeCheckGroup) in objects-debug.
  v8::platform::PrintStackTrace
  v8::internal::Map::VerifyOmittedMapChecks
  
Sanitizer: address (ASAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5071770997751808


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Every check failure is considered security implication by default, leaving for v8 folks to triage.

danno: if this has security implications, please assign a severity/impact label otherwise change this to a non-security bug. Thanks!

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/9a0403a67945ecbc150f5466b455f8912b25c803

commit 9a0403a67945ecbc150f5466b455f8912b25c803
Author: Daniel Clifford <danno@chromium.org>
Date: Mon Jul 17 12:54:32 2017

Don't add dependencies on prototype chain when inlining forEach

Bug= chromium:740784 
LOG=N

Change-Id: I61fe1b07426d0b1e5131687c9ce99a8dbfa09781
Reviewed-on: https://chromium-review.googlesource.com/574175
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46706}
[modify] https://crrev.com/9a0403a67945ecbc150f5466b455f8912b25c803/src/compiler/js-call-reducer.cc
[modify] https://crrev.com/9a0403a67945ecbc150f5466b455f8912b25c803/test/mjsunit/mjsunit.status
[add] https://crrev.com/9a0403a67945ecbc150f5466b455f8912b25c803/test/mjsunit/regress/regress-740784.js

ping: danno looks like you've landed a fix but please update severity/impact labels if this is a security issue.

ClusterFuzz has detected this issue as fixed in range 487123:487163.

Detailed report: https://clusterfuzz.com/testcase?key=5013610563895296

Fuzzer: inferno_js_fuzzer
Job Type: windows_asan_d8
Platform Id: windows

Crash Type: CHECK failure
Crash Address: 
Crash State:
  dependent_code()->IsEmpty(DependentCode::kPrototypeCheckGroup) in objects-debug.
  v8::platform::PrintStackTrace
  v8::internal::Map::VerifyOmittedMapChecks
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_d8&range=485293:485305
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_d8&range=487123:487163

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5013610563895296


See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5013610563895296 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot