This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Regression range points to 5931cc9409eb47fe363b1fc445131a429af640d8. Reproduces nicely. Assigning to franzih@ because issue tracker does not allow me to assign to mslekova@.

Fix is under review: https://chromium-review.googlesource.com/c/v8/v8/+/663218

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/8a568bd74ef04af1887fdbe43a1937eeee64b137

commit 8a568bd74ef04af1887fdbe43a1937eeee64b137
Author: Maya Lekova <mslekova@google.com>
Date: Tue Sep 12 16:42:12 2017

Improve error handling of proxies get property

Bug:  chromium:763683 , v8:6560
Change-Id: I0769a8a2280a08fe0c768b6330d15cfbb1500f6b
Reviewed-on: https://chromium-review.googlesource.com/663218
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47978}
[modify] https://crrev.com/8a568bd74ef04af1887fdbe43a1937eeee64b137/src/runtime/runtime-proxy.cc
[add] https://crrev.com/8a568bd74ef04af1887fdbe43a1937eeee64b137/test/mjsunit/regress/regress-crbug-763683.js

ClusterFuzz has detected this issue as fixed in range 47977:47978.

Detailed report: https://clusterfuzz.com/testcase?key=5073137061593088

Fuzzer: inferno_js_fuzzer
Job Type: mac_asan_d8_dbg
Platform Id: mac

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  !__isolate__->has_pending_exception() in runtime-proxy.cc
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_d8_dbg&range=47771:47772
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_d8_dbg&range=47977:47978

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5073137061593088

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5073137061593088 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug requires manual review: M62 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: amineer@(Android), cmasso@(iOS), bhthompson@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

+awhalley@
Approving merge for M62. Branch:3202

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/d0983e819c7908ed02328e86cc1aeeae7e2e41cc

commit d0983e819c7908ed02328e86cc1aeeae7e2e41cc
Author: Maya Lekova <mslekova@google.com>
Date: Wed Sep 20 12:44:20 2017

Merged: Improve error handling of proxies get property

Revision: 8a568bd74ef04af1887fdbe43a1937eeee64b137

BUG= chromium:763683 ,v8:6560
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=ishell@chromium.org

Change-Id: I57a94de1c49586f17e345449f2064ceeb31c0511
Reviewed-on: https://chromium-review.googlesource.com/674873
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.2@{#31}
Cr-Branched-From: efa2ac4129d30c7c72e84c16af3d20b44829f990-refs/heads/6.2.414@{#1}
Cr-Branched-From: a861ebb762a60bf5cc2a274faee3620abfb06311-refs/heads/master@{#47693}
[modify] https://crrev.com/d0983e819c7908ed02328e86cc1aeeae7e2e41cc/src/runtime/runtime-proxy.cc
[add] https://crrev.com/d0983e819c7908ed02328e86cc1aeeae7e2e41cc/test/mjsunit/regress/regress-crbug-763683.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/4dcecdac414a9cf99df5248f328905d063e34439

commit 4dcecdac414a9cf99df5248f328905d063e34439
Author: Michael Achenbach <machenbach@chromium.org>
Date: Wed Sep 20 14:22:30 2017

Revert "Merged: Improve error handling of proxies get property"

This reverts commit d0983e819c7908ed02328e86cc1aeeae7e2e41cc.

Reason for revert: Doesn't compile on branch:
https://build.chromium.org/p/client.v8.branches/builders/V8%20Linux64%20-%20beta%20branch/builds/646

Original change's description:
> Merged: Improve error handling of proxies get property
> 
> Revision: 8a568bd74ef04af1887fdbe43a1937eeee64b137
> 
> BUG= chromium:763683 ,v8:6560
> LOG=N
> NOTRY=true
> NOPRESUBMIT=true
> NOTREECHECKS=true
> R=​ishell@chromium.org
> 
> Change-Id: I57a94de1c49586f17e345449f2064ceeb31c0511
> Reviewed-on: https://chromium-review.googlesource.com/674873
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/branch-heads/6.2@{#31}
> Cr-Branched-From: efa2ac4129d30c7c72e84c16af3d20b44829f990-refs/heads/6.2.414@{#1}
> Cr-Branched-From: a861ebb762a60bf5cc2a274faee3620abfb06311-refs/heads/master@{#47693}

TBR=machenbach@chromium.org,ishell@chromium.org,mslekova@google.com

Change-Id: I7022409553ce45d50a550bded8ce52cf3d87f886
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  chromium:763683 , v8:6560
Reviewed-on: https://chromium-review.googlesource.com/675123
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.2@{#34}
Cr-Branched-From: efa2ac4129d30c7c72e84c16af3d20b44829f990-refs/heads/6.2.414@{#1}
Cr-Branched-From: a861ebb762a60bf5cc2a274faee3620abfb06311-refs/heads/master@{#47693}
[modify] https://crrev.com/4dcecdac414a9cf99df5248f328905d063e34439/src/runtime/runtime-proxy.cc
[delete] https://crrev.com/fa5e85516a8bb6b69c70dbea211d34a7c5d7bbcb/test/mjsunit/regress/regress-crbug-763683.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/42a17d8ba5737f1dd2be34f762dd9fbd1dcbbedd

commit 42a17d8ba5737f1dd2be34f762dd9fbd1dcbbedd
Author: Maya Lekova <mslekova@google.com>
Date: Thu Sep 21 08:14:51 2017

Merged: Improve error handling of proxies get property

Revision: 8a568bd74ef04af1887fdbe43a1937eeee64b137

BUG= chromium:763683 ,v8:6560
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=ishell@chromium.org

Change-Id: I5eb8f66d281d613617b73c0d8cb5b6117a0cddb9
Reviewed-on: https://chromium-review.googlesource.com/676845
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Maya Lekova <mslekova@google.com>
Cr-Commit-Position: refs/branch-heads/6.2@{#36}
Cr-Branched-From: efa2ac4129d30c7c72e84c16af3d20b44829f990-refs/heads/6.2.414@{#1}
Cr-Branched-From: a861ebb762a60bf5cc2a274faee3620abfb06311-refs/heads/master@{#47693}
[modify] https://crrev.com/42a17d8ba5737f1dd2be34f762dd9fbd1dcbbedd/src/lookup.cc
[modify] https://crrev.com/42a17d8ba5737f1dd2be34f762dd9fbd1dcbbedd/src/lookup.h
[modify] https://crrev.com/42a17d8ba5737f1dd2be34f762dd9fbd1dcbbedd/src/runtime/runtime-proxy.cc
[add] https://crrev.com/42a17d8ba5737f1dd2be34f762dd9fbd1dcbbedd/test/mjsunit/regress/regress-crbug-763683.js

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot