Regression range points to 21e7f083851e211cb2af062371d5e3656ec5f38a.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/c558369af2f4a53d4b9fdff9534fdc202f27c098

commit c558369af2f4a53d4b9fdff9534fdc202f27c098
Author: Igor Sheludko <ishell@chromium.org>
Date: Tue Jul 25 06:54:46 2017

[runtime] Don't create "class" field types for arrays' fields.

... when reconfiguring const fields to mutable fields.

Bug:  chromium:747979 ,  chromium:738763 ,  chromium:745844 
Change-Id: Ibfac1b875a1da8234966ac10658260f1cc718fe5
Reviewed-on: https://chromium-review.googlesource.com/583647
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46854}
[modify] https://crrev.com/c558369af2f4a53d4b9fdff9534fdc202f27c098/src/map-updater.cc
[modify] https://crrev.com/c558369af2f4a53d4b9fdff9534fdc202f27c098/src/objects-debug.cc
[add] https://crrev.com/c558369af2f4a53d4b9fdff9534fdc202f27c098/test/mjsunit/regress/regress-crbug-747979.js

ClusterFuzz has detected this issue as fixed in range 46853:46854.

Detailed report: https://clusterfuzz.com/testcase?key=5939555751690240

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_v8_arm64_dbg
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  !IsInplaceGeneralizableField(details.constness(), details.representation(), desc
  v8::internal::Map::EquivalentToForElementsKindTransition
  v8::internal::Map::FindElementsKindTransitionedMap
  
Sanitizer: address (ASAN)

Regressed: V8: 46829:46830
Fixed: V8: 46853:46854

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5939555751690240


See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5939555751690240 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/10e4fe3d32c5ca205948ca44f4f2b9edd50b7755

commit 10e4fe3d32c5ca205948ca44f4f2b9edd50b7755
Author: Igor Sheludko <ishell@chromium.org>
Date: Thu Jul 27 07:11:05 2017

[runtime] Don't create class field types for arrays' fields.

... when generalizing const fields to mutable fields.

Bug:  chromium:748539 ,  chromium:747979 ,  chromium:738763 
Change-Id: Iee772a5d0cddd23599f1f68bca00b8beecb76da0
Reviewed-on: https://chromium-review.googlesource.com/586709
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46921}
[modify] https://crrev.com/10e4fe3d32c5ca205948ca44f4f2b9edd50b7755/src/map-updater.cc
[modify] https://crrev.com/10e4fe3d32c5ca205948ca44f4f2b9edd50b7755/src/map-updater.h
[modify] https://crrev.com/10e4fe3d32c5ca205948ca44f4f2b9edd50b7755/src/objects.cc
[modify] https://crrev.com/10e4fe3d32c5ca205948ca44f4f2b9edd50b7755/src/objects/map-inl.h
[modify] https://crrev.com/10e4fe3d32c5ca205948ca44f4f2b9edd50b7755/src/objects/map.h
[add] https://crrev.com/10e4fe3d32c5ca205948ca44f4f2b9edd50b7755/test/mjsunit/regress/regress-crbug-748539.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6

commit b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6
Author: ishell@chromium.org <ishell@chromium.org>
Date: Fri Jul 28 09:33:02 2017

Merged: Squashed multiple commits.

Merged: [runtime] Don't track "class" field types for arrays with properties.
Revision: 21e7f083851e211cb2af062371d5e3656ec5f38a

Merged: [runtime] Don't create "class" field types for arrays' fields.
Revision: c558369af2f4a53d4b9fdff9534fdc202f27c098

Merged: [runtime] Don't create class field types for arrays' fields.
Revision: 10e4fe3d32c5ca205948ca44f4f2b9edd50b7755

BUG= chromium:738763 , chromium:745844 , chromium:747979 , chromium:748539 
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=hablich@chromium.org

Change-Id: I73e305aacfb532121f1621078a46f465cf463b05
Reviewed-on: https://chromium-review.googlesource.com/590230
Reviewed-by: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.1@{#22}
Cr-Branched-From: 1bf2e10ddb194d4c2871a87a4732613419de892d-refs/heads/6.1.534@{#1}
Cr-Branched-From: e825c4318eb2065ffdf9044aa6a5278635c36427-refs/heads/master@{#46746}
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/src/map-updater.cc
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/src/map-updater.h
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/src/objects-debug.cc
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/src/objects.cc
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/src/objects.h
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/src/objects/map-inl.h
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/src/objects/map.h
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/test/cctest/test-field-type-tracking.cc
[add] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/test/mjsunit/regress/regress-crbug-738763.js
[add] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/test/mjsunit/regress/regress-crbug-747979.js
[add] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/test/mjsunit/regress/regress-crbug-748539.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/02d47a027fac8057e7e3923ad1d488ecad3a5381

commit 02d47a027fac8057e7e3923ad1d488ecad3a5381
Author: ishell@chromium.org <ishell@chromium.org>
Date: Fri Jul 28 11:25:20 2017

Merged: Squashed multiple commits.

Merged: [runtime] Don't track "class" field types for arrays with properties.
Revision: 21e7f083851e211cb2af062371d5e3656ec5f38a

Merged: [runtime] Don't create "class" field types for arrays' fields.
Revision: c558369af2f4a53d4b9fdff9534fdc202f27c098

Merged: [runtime] Don't create class field types for arrays' fields.
Revision: 10e4fe3d32c5ca205948ca44f4f2b9edd50b7755

BUG= chromium:738763 , chromium:745844 , chromium:747979 , chromium:748539 
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=hablich@chromium.org

Change-Id: I4e3b4717aca1516aa3b531afd23313f6c24cb4c4
Reviewed-on: https://chromium-review.googlesource.com/590232
Reviewed-by: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.0@{#99}
Cr-Branched-From: 97dbf624a5eeffb3a8df36d24cdb2a883137385f-refs/heads/6.0.286@{#1}
Cr-Branched-From: 12e6f1cb5cd9616da7b9d4a7655c088778a6d415-refs/heads/master@{#45439}
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/src/map-updater.cc
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/src/map-updater.h
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/src/objects-debug.cc
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/src/objects.cc
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/src/objects.h
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/src/objects/map-inl.h
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/src/objects/map.h
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/test/cctest/test-field-type-tracking.cc
[add] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/test/mjsunit/regress/regress-crbug-738763.js
[add] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/test/mjsunit/regress/regress-crbug-747979.js
[add] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/test/mjsunit/regress/regress-crbug-748539.js

Afraid this was hit by our internal fuzzers within 48 hours of this report.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot