This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

jkummerow, are you still the best person to get assigned to these?

#4: I am not. V8 team has a dedicated ClusterFuzz sheriffing rotation, see go/v8.

In this case, the issue is CF-only, the regression range is bogus, and the fix is simple: https://chromium-review.googlesource.com/c/610706. Dropping labels.

Note that %NeverOptimizeFunction is actually _not_ on the ClusterFuzz white-list. Maybe the black-listing mechanism is confused because the call appears as part of a string and is then eval'ed (just a guess). The current white-list reads ...

RUNTIME_FUNCTION_WHITELIST = [
    # List of allowed runtime functions. Others will be replaced with no-ops.
    '%ArrayBufferNeuter',
    '%DeoptimizeFunction',
    '%DeoptimizeNow',
    '%GetUndetectable',
    '%HeapObjectVerify',
    '%OptimizeFunctionOnNextCall',
]

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/89e5792d60a9c8db67efeef58b03aa886c11c60b

commit 89e5792d60a9c8db67efeef58b03aa886c11c60b
Author: Jakob Kummerow <jkummerow@chromium.org>
Date: Fri Aug 11 14:56:45 2017

[tests] Make %NeverOptimizeFunction ClusterFuzz safe

It expected its argument to be a JSFunction, but fuzzer tests can
pass anything. Non-JSFunction arguments should just silently be
ignored, just like similar CF-whitelisted runtime functions do.

Bug:  chromium:754177 
Change-Id: I41b29528bbe72f24b3d84f021b22602160769d26
Reviewed-on: https://chromium-review.googlesource.com/610706
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47316}
[modify] https://crrev.com/89e5792d60a9c8db67efeef58b03aa886c11c60b/src/runtime/runtime-test.cc
[add] https://crrev.com/89e5792d60a9c8db67efeef58b03aa886c11c60b/test/mjsunit/regress/regress-crbug-754177.js

ClusterFuzz has detected this issue as fixed in range 493908:493937.

Detailed report: https://clusterfuzz.com/testcase?key=6367612257959936

Fuzzer: inferno_js_fuzzer
Job Type: linux_cfi_d8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  args[0]->IsJSFunction() in runtime-test.cc
  
Sanitizer: cfi (CFI)

Regressed: https://clusterfuzz.com/revisions?job=linux_cfi_d8&range=405123:405173
Fixed: https://clusterfuzz.com/revisions?job=linux_cfi_d8&range=493908:493937

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6367612257959936

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6367612257959936 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.