Regression range and stack trace points to b90e83f5da40b214646327f8791834eeb5ddedd4.

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

ClusterFuzz has detected this issue as fixed in range 46659:46660.

Detailed report: https://clusterfuzz.com/testcase?key=5639820016877568

Fuzzer: v8_builtins_generator
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  target->constructor_or_backpointer() == map in mark-compact.cc
  v8::internal::MarkCompactCollector::CompactTransitionArray
  v8::internal::MarkCompactCollector::ClearFullMapTransitions
  
Sanitizer: address (ASAN)

Regressed: V8: 46621:46622
Fixed: V8: 46659:46660

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5639820016877568


See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5639820016877568 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/6e27386d68eb737b98d37cb32e14d6bea1fd62cd

commit 6e27386d68eb737b98d37cb32e14d6bea1fd62cd
Author: Igor Sheludko <ishell@chromium.org>
Date: Wed Jul 19 11:31:21 2017

Reland "[runtime] Add shortcuts for elements kinds transitions."

This is a reland of b90e83f5da40b214646327f8791834eeb5ddedd4
Original change's description:
> [runtime] Add shortcuts for elements kinds transitions.
>
> The shortcuts ensure that field type generalization is properly
> propagated in the transition graph.
>
> Bug:  chromium:738763 
> Change-Id: Id701a6f95ed6ea093c707fbe0bac228f1f856e9f
> Reviewed-on: https://chromium-review.googlesource.com/567992
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46622}

Bug:  chromium:738763 ,  chromium:742346 ,  chromium:742381 ,  chromium:745844 
Change-Id: I93974e3906b2c7710bd525f15037a2dd97f263ad
Reviewed-on: https://chromium-review.googlesource.com/575227
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46759}
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/heap-symbols.h
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/heap/mark-compact.cc
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/ic/ic.cc
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/map-updater.cc
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/objects-debug.cc
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/objects-inl.h
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/objects-printer.cc
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/objects.cc
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/objects.h
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/objects/map.h
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/transitions-inl.h
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/transitions.cc
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/src/transitions.h
[modify] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/test/cctest/test-field-type-tracking.cc
[add] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/test/mjsunit/regress/regress-crbug-738763.js
[add] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/test/mjsunit/regress/regress-crbug-742346.js
[add] https://crrev.com/6e27386d68eb737b98d37cb32e14d6bea1fd62cd/test/mjsunit/regress/regress-crbug-742381.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/5520cae3fd599cb77b4b9c744b07548459655ee3

commit 5520cae3fd599cb77b4b9c744b07548459655ee3
Author: Igor Sheludko <ishell@chromium.org>
Date: Mon Jul 24 05:31:29 2017

Revert "Reland "[runtime] Add shortcuts for elements kinds transitions.""

This reverts commit 6e27386d68eb737b98d37cb32e14d6bea1fd62cd.

Reason for revert: There will be another much simpler and
back-mergeable fix.

Original change's description:
> Reland "[runtime] Add shortcuts for elements kinds transitions."
> 
> This is a reland of b90e83f5da40b214646327f8791834eeb5ddedd4
> Original change's description:
> > [runtime] Add shortcuts for elements kinds transitions.
> >
> > The shortcuts ensure that field type generalization is properly
> > propagated in the transition graph.
> >
> > Bug:  chromium:738763 
> > Change-Id: Id701a6f95ed6ea093c707fbe0bac228f1f856e9f
> > Reviewed-on: https://chromium-review.googlesource.com/567992
> > Commit-Queue: Igor Sheludko <ishell@chromium.org>
> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#46622}
> 
> Bug:  chromium:738763 ,  chromium:742346 ,  chromium:742381 ,  chromium:745844 
> Change-Id: I93974e3906b2c7710bd525f15037a2dd97f263ad
> Reviewed-on: https://chromium-review.googlesource.com/575227
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46759}

TBR=ulan@chromium.org,jkummerow@chromium.org,ishell@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug:  chromium:738763 ,  chromium:742346 ,  chromium:742381 ,  chromium:745844 
Change-Id: I203dc748c47db554e0a86d61f0e2b7b8b96f2370
Reviewed-on: https://chromium-review.googlesource.com/581547
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46826}
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/heap-symbols.h
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/heap/mark-compact.cc
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/ic/ic.cc
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/map-updater.cc
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/objects-debug.cc
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/objects-inl.h
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/objects-printer.cc
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/objects.cc
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/objects.h
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/objects/map.h
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/transitions-inl.h
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/transitions.cc
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/src/transitions.h
[modify] https://crrev.com/5520cae3fd599cb77b4b9c744b07548459655ee3/test/cctest/test-field-type-tracking.cc
[delete] https://crrev.com/b1f0e653f48afe9e9d378a3d97c70f9a03582a78/test/mjsunit/regress/regress-crbug-738763.js
[delete] https://crrev.com/b1f0e653f48afe9e9d378a3d97c70f9a03582a78/test/mjsunit/regress/regress-crbug-742346.js
[delete] https://crrev.com/b1f0e653f48afe9e9d378a3d97c70f9a03582a78/test/mjsunit/regress/regress-crbug-742381.js

Hi ishell@ - mind confirming that M61's got what it needs to fix the Clusterfuzz issue there? Want to make sure I'm tracking the reverts and relands correctly :-)

#10: I believe https://chromium.googlesource.com/v8/v8/+/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6 is the relevant merge.

excellent, thanks jkummerow@!

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot