This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Bisects to 217012973c2ee5c666260ffd9aa3a6ab475f1aa2 ([turbofan] Introduce new JSConstructWithArrayLike operator.).

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/cb9402aa98c0dd555c03fa66b758d6ab13ec00b2

commit cb9402aa98c0dd555c03fa66b758d6ab13ec00b2
Author: Benedikt Meurer <bmeurer@chromium.org>
Date: Mon Aug 07 18:15:30 2017

[turbofan] Properly check new.target parameter in inlined Reflect.construct.

The ConstructFunctionForwardVarargs and ConstructForwardVarargs
builtins, which are used when inlining the Reflect.construct
builtin into TurboFan optimized code, didn't properly check the
new.target parameter whether it's a constructor.

Bug:  chromium:752481 
Change-Id: I9b8f8c429d6eaed0ff8d27fc3f6b52eb906766a2
Reviewed-on: https://chromium-review.googlesource.com/604187
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47206}
[modify] https://crrev.com/cb9402aa98c0dd555c03fa66b758d6ab13ec00b2/src/builtins/arm/builtins-arm.cc
[modify] https://crrev.com/cb9402aa98c0dd555c03fa66b758d6ab13ec00b2/src/builtins/arm64/builtins-arm64.cc
[modify] https://crrev.com/cb9402aa98c0dd555c03fa66b758d6ab13ec00b2/src/builtins/builtins-call-gen.cc
[modify] https://crrev.com/cb9402aa98c0dd555c03fa66b758d6ab13ec00b2/src/builtins/builtins-constructor-gen.cc
[modify] https://crrev.com/cb9402aa98c0dd555c03fa66b758d6ab13ec00b2/src/builtins/builtins.h
[modify] https://crrev.com/cb9402aa98c0dd555c03fa66b758d6ab13ec00b2/src/builtins/ia32/builtins-ia32.cc
[modify] https://crrev.com/cb9402aa98c0dd555c03fa66b758d6ab13ec00b2/src/builtins/mips/builtins-mips.cc
[modify] https://crrev.com/cb9402aa98c0dd555c03fa66b758d6ab13ec00b2/src/builtins/mips64/builtins-mips64.cc
[modify] https://crrev.com/cb9402aa98c0dd555c03fa66b758d6ab13ec00b2/src/builtins/x64/builtins-x64.cc
[add] https://crrev.com/cb9402aa98c0dd555c03fa66b758d6ab13ec00b2/test/mjsunit/regress/regress-crbug-752481.js

ClusterFuzz has detected this issue as fixed in range 492522:492537.

Detailed report: https://clusterfuzz.com/testcase?key=5459844512612352

Fuzzer: inferno_js_fuzzer
Job Type: linux_cfi_d8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  args[1]->IsJSReceiver() in runtime-object.cc
  
Sanitizer: cfi (CFI)

Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_d8&range=481287:481360
Fixed: https://clusterfuzz.com/revisions?job=linux_cfi_d8&range=492522:492537

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5459844512612352


See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5459844512612352 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot