(Security Sheriff Triage)
If you aren't the correct owner for this issue, please assign as appropriate.

Detailed report: https://clusterfuzz.com/testcase?key=6589417656680448

Fuzzer: inferno_js_fuzzer
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  is_transitionable_fast_elements_kind implies !Map::IsInplaceGeneralizableField(d
  v8::internal::JSObject::JSObjectVerify
  v8::internal::JSObject::MigrateInstance
  
Sanitizer: address (ASAN)

Regressed: V8: 46853:46854

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6589417656680448


See https://github.com/google/clusterfuzz-tools for more information.

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

URGENT - PTAL.
Your bug is labelled as Stable ReleaseBlock, pls make sure to land the fix and get it merged into the M61 branch #3163 ASAP to have enough baking time in Beta before Stable promotion. Thank you!

Know that this issue shouldn't block the release?  Remove the ReleaseBlock-Stable label.

Looks like the regression range is in M62, changing milestone.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/10e4fe3d32c5ca205948ca44f4f2b9edd50b7755

commit 10e4fe3d32c5ca205948ca44f4f2b9edd50b7755
Author: Igor Sheludko <ishell@chromium.org>
Date: Thu Jul 27 07:11:05 2017

[runtime] Don't create class field types for arrays' fields.

... when generalizing const fields to mutable fields.

Bug:  chromium:748539 ,  chromium:747979 ,  chromium:738763 
Change-Id: Iee772a5d0cddd23599f1f68bca00b8beecb76da0
Reviewed-on: https://chromium-review.googlesource.com/586709
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46921}
[modify] https://crrev.com/10e4fe3d32c5ca205948ca44f4f2b9edd50b7755/src/map-updater.cc
[modify] https://crrev.com/10e4fe3d32c5ca205948ca44f4f2b9edd50b7755/src/map-updater.h
[modify] https://crrev.com/10e4fe3d32c5ca205948ca44f4f2b9edd50b7755/src/objects.cc
[modify] https://crrev.com/10e4fe3d32c5ca205948ca44f4f2b9edd50b7755/src/objects/map-inl.h
[modify] https://crrev.com/10e4fe3d32c5ca205948ca44f4f2b9edd50b7755/src/objects/map.h
[add] https://crrev.com/10e4fe3d32c5ca205948ca44f4f2b9edd50b7755/test/mjsunit/regress/regress-crbug-748539.js

ClusterFuzz has detected this issue as fixed in range 46920:46921.

Detailed report: https://clusterfuzz.com/testcase?key=6589417656680448

Fuzzer: inferno_js_fuzzer
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  is_transitionable_fast_elements_kind implies !Map::IsInplaceGeneralizableField(d
  v8::internal::JSObject::JSObjectVerify
  v8::internal::JSObject::MigrateInstance
  
Sanitizer: address (ASAN)

Regressed: V8: 46853:46854
Fixed: V8: 46920:46921

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6589417656680448


See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 46920:46921.

Detailed report: https://clusterfuzz.com/testcase?key=5352347554545664

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  is_transitionable_fast_elements_kind implies !Map::IsInplaceGeneralizableField(d
  
Sanitizer: address (ASAN)

Regressed: V8: 46853:46854
Fixed: V8: 46920:46921

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5352347554545664


See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5352347554545664 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6

commit b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6
Author: ishell@chromium.org <ishell@chromium.org>
Date: Fri Jul 28 09:33:02 2017

Merged: Squashed multiple commits.

Merged: [runtime] Don't track "class" field types for arrays with properties.
Revision: 21e7f083851e211cb2af062371d5e3656ec5f38a

Merged: [runtime] Don't create "class" field types for arrays' fields.
Revision: c558369af2f4a53d4b9fdff9534fdc202f27c098

Merged: [runtime] Don't create class field types for arrays' fields.
Revision: 10e4fe3d32c5ca205948ca44f4f2b9edd50b7755

BUG= chromium:738763 , chromium:745844 , chromium:747979 , chromium:748539 
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=hablich@chromium.org

Change-Id: I73e305aacfb532121f1621078a46f465cf463b05
Reviewed-on: https://chromium-review.googlesource.com/590230
Reviewed-by: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.1@{#22}
Cr-Branched-From: 1bf2e10ddb194d4c2871a87a4732613419de892d-refs/heads/6.1.534@{#1}
Cr-Branched-From: e825c4318eb2065ffdf9044aa6a5278635c36427-refs/heads/master@{#46746}
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/src/map-updater.cc
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/src/map-updater.h
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/src/objects-debug.cc
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/src/objects.cc
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/src/objects.h
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/src/objects/map-inl.h
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/src/objects/map.h
[modify] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/test/cctest/test-field-type-tracking.cc
[add] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/test/mjsunit/regress/regress-crbug-738763.js
[add] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/test/mjsunit/regress/regress-crbug-747979.js
[add] https://crrev.com/b9b0a2e72ef15cd9e30a6bd99f343a9aa7fc26c6/test/mjsunit/regress/regress-crbug-748539.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/02d47a027fac8057e7e3923ad1d488ecad3a5381

commit 02d47a027fac8057e7e3923ad1d488ecad3a5381
Author: ishell@chromium.org <ishell@chromium.org>
Date: Fri Jul 28 11:25:20 2017

Merged: Squashed multiple commits.

Merged: [runtime] Don't track "class" field types for arrays with properties.
Revision: 21e7f083851e211cb2af062371d5e3656ec5f38a

Merged: [runtime] Don't create "class" field types for arrays' fields.
Revision: c558369af2f4a53d4b9fdff9534fdc202f27c098

Merged: [runtime] Don't create class field types for arrays' fields.
Revision: 10e4fe3d32c5ca205948ca44f4f2b9edd50b7755

BUG= chromium:738763 , chromium:745844 , chromium:747979 , chromium:748539 
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=hablich@chromium.org

Change-Id: I4e3b4717aca1516aa3b531afd23313f6c24cb4c4
Reviewed-on: https://chromium-review.googlesource.com/590232
Reviewed-by: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.0@{#99}
Cr-Branched-From: 97dbf624a5eeffb3a8df36d24cdb2a883137385f-refs/heads/6.0.286@{#1}
Cr-Branched-From: 12e6f1cb5cd9616da7b9d4a7655c088778a6d415-refs/heads/master@{#45439}
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/src/map-updater.cc
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/src/map-updater.h
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/src/objects-debug.cc
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/src/objects.cc
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/src/objects.h
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/src/objects/map-inl.h
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/src/objects/map.h
[modify] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/test/cctest/test-field-type-tracking.cc
[add] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/test/mjsunit/regress/regress-crbug-738763.js
[add] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/test/mjsunit/regress/regress-crbug-747979.js
[add] https://crrev.com/02d47a027fac8057e7e3923ad1d488ecad3a5381/test/mjsunit/regress/regress-crbug-748539.js

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot