Automatically applying components based on crash stacktrace and information from OWNERS files. If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Introduced by shipping "--harmony-async-iteration" it seems.

Fix submitted for review in https://chromium-review.googlesource.com/c/v8/v8/+/700261

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/f3fb1b77989fe6fd1158062fbc1c405549bd4b76

commit f3fb1b77989fe6fd1158062fbc1c405549bd4b76
Author: Caitlin Potter <caitp@igalia.com>
Date: Wed Oct 04 16:15:59 2017

[esnext] initialize native_context()->initial_async_generator_prototype

Fix an error overwriting the `prototype` property of async generator
functions when FLAG_enable_slow_asserts is enabled.

Previously, the `initial_async_generator_prototype` field was never
written to the native context, and was always undefined. This caused
some incorrect runtime behaviour, and would crash when loading the field
using the Context::initial_aysnc_generator_prototype accessor when
attempting to cast the Undefined oddball to a JSObject.

BUG= chromium:771470 ,  v8:5855 
R=adamk@chromium.org, verwaest@chromium.org, gsathya@chromium.org

Change-Id: I13f2a518c59852bc77c2de1f2468a4eea457609e
Reviewed-on: https://chromium-review.googlesource.com/700261
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#48291}
[modify] https://crrev.com/f3fb1b77989fe6fd1158062fbc1c405549bd4b76/src/bootstrapper.cc
[add] https://crrev.com/f3fb1b77989fe6fd1158062fbc1c405549bd4b76/test/mjsunit/harmony/regress/regress-771470.js

ClusterFuzz has detected this issue as fixed in range 48290:48291.

Detailed report: https://clusterfuzz.com/testcase?key=4924073259040768

Fuzzer: ochang_js_fuzzer
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !v8::internal::FLAG_enable_slow_asserts || (object->IsJSObject()) in objects-inl
  cast
  v8::internal::Context::initial_async_generator_prototype
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=48067:48068
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=48290:48291

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4924073259040768

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4924073259040768 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot