Regression range points to 31800120ccb215cdd1b6b1bde7fd05ecf72ee16e.

To reproduce without the launcher script use the following command ...

$ ~/Development/v8.git/out/x64.debug/d8 --verify-heap ~/Development/v8.git/test/mjsunit/mjsunit.js -e "try { load('mutant1617_regress-357108.js') } catch(e) { print(e.stack) }"

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/71012480b7ca7c1bdb94f8beb6a65e18c52e9ad4

commit 71012480b7ca7c1bdb94f8beb6a65e18c52e9ad4
Author: Benedikt Meurer <bmeurer@chromium.org>
Date: Wed Aug 02 11:08:38 2017

[runtime] Properly forward the "interesting symbol" bit.

This fixes a corner case of rewriting the transition trees, where the
"interesting symbols" bit was not properly forwarded.

Drive-by-fix: Introduce additional checking in Map::ConnectTransition to
make it easier for clusterfuzz to detect cases we might have missed.

R=mstarzinger@chromium.org

Bug:  chromium:751109 
Change-Id: I3f1a1e6232db9b3694064b3d4e9f37255b018acc
Reviewed-on: https://chromium-review.googlesource.com/597669
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47075}
[modify] https://crrev.com/71012480b7ca7c1bdb94f8beb6a65e18c52e9ad4/src/objects.cc
[add] https://crrev.com/71012480b7ca7c1bdb94f8beb6a65e18c52e9ad4/test/mjsunit/regress/regress-crbug-751109.js

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Not security relevant at all, and the bug was just introduced yesterday.

ClusterFuzz has detected this issue as fixed in range 47074:47075.

Detailed report: https://clusterfuzz.com/testcase?key=6596388506042368

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !descriptors->GetKey(i)->IsInterestingSymbol() in objects-debug.cc
  v8::internal::Map::MapVerify
  v8::internal::Object::ObjectVerify
  
Sanitizer: address (ASAN)

Regressed: V8: 47033:47034
Fixed: V8: 47074:47075

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6596388506042368


See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6596388506042368 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot