Introduced by https://chromium.googlesource.com/v8/v8/+/ac4756360f56aadd42c1cc27925cfee37b01936f PTAL

 Issue 770004  has been merged into this issue.

 Issue 770135  has been merged into this issue.

Interesting, at first glance this looks like bad interaction between inline allocation of closures and the inlining of the Array.prtotype.forEach builtin. I'll take a look. Thanks!

Yep, suspicion was correct. Bug has actually been in there for a while and the new inline allocation just flushed it out. I am cooking up a fix.

Automatically applying components based on information from OWNERS files. If this seems incorrect, please apply the Test-Predator-Wrong-Components label.

 Issue 770516  has been merged into this issue.

 Issue 770578  has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/17d86d76fb6e452436352b0b7cc19051902d2e44

commit 17d86d76fb6e452436352b0b7cc19051902d2e44
Author: Michael Starzinger <mstarzinger@chromium.org>
Date: Mon Oct 02 13:23:45 2017

[deoptimizer] Materialize objects with top-most stub frame.

This makes sure the deoptimizer properly materializes heap objects, even
when the top-most frame happens to be a stub-frame. Without this step
the {arguments_marker} would leak into user-land and most likely be
treated as an undefined value.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-769852
BUG= chromium:769852 

Change-Id: I4ba17501c5d7e68d1f402b7c2cc5ccb0fb7bfb05
Reviewed-on: https://chromium-review.googlesource.com/691996
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48262}
[modify] https://crrev.com/17d86d76fb6e452436352b0b7cc19051902d2e44/src/deoptimizer.cc
[modify] https://crrev.com/17d86d76fb6e452436352b0b7cc19051902d2e44/src/runtime/runtime-compiler.cc
[add] https://crrev.com/17d86d76fb6e452436352b0b7cc19051902d2e44/test/mjsunit/regress/regress-crbug-769852.js

ClusterFuzz has detected this issue as fixed in range 48261:48262.

Detailed report: https://clusterfuzz.com/testcase?key=5627988954841088

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition:x64,ignition_turbo
  sources: 89e
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=v8_foozzie&range=48197:48198
Fixed: https://clusterfuzz.com/revisions?job=v8_foozzie&range=48261:48262

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5627988954841088

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5919047681310720 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.