Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/d6ff08223bab0a0ca8b5c8413b13f87257cf1a58 (Revert "[turbofan] Temporarily turn off escape analysis.").

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/57c6c9790434f0cefcf51343ead179d4e9944dca

commit 57c6c9790434f0cefcf51343ead179d4e9944dca
Author: Jaroslav Sevcik <jarin@chromium.org>
Date: Wed Oct 18 08:13:51 2017

[deoptimizer] Remove incorrect cast for materialized property array.

Bug:  chromium:774824 
Change-Id: Id3d0af0bb55c0985393fe3b139308b6b706e7bc0
Reviewed-on: https://chromium-review.googlesource.com/725339
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48665}
[modify] https://crrev.com/57c6c9790434f0cefcf51343ead179d4e9944dca/src/deoptimizer.cc
[add] https://crrev.com/57c6c9790434f0cefcf51343ead179d4e9944dca/test/mjsunit/regress/regress-774824.js

ClusterFuzz has detected this issue as fixed in range 48664:48665.

Detailed report: https://clusterfuzz.com/testcase?key=6390426767720448

Fuzzer: ochang_js_fuzzer
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !v8::internal::FLAG_enable_slow_asserts || (object->IsFixedArray()) in objects-i
  cast
  v8::internal::TranslatedState::MaterializeCapturedObjectAt
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=48063:48064
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=48664:48665

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6390426767720448

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6390426767720448 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot