This reproduces locally with a normal debug build.

Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

 Issue 776315  has been merged into this issue.

Fix in flight:

https://chromium-review.googlesource.com/c/v8/v8/+/727900

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/0454a842d143ae260d920f54bc2f8278aff9b186

commit 0454a842d143ae260d920f54bc2f8278aff9b186
Author: Daniel Clifford <danno@chromium.org>
Date: Thu Oct 19 15:05:44 2017

Ensure inlined Array.protoype.shift() calls return non-COW arrays

Also ensure that CSA's CloneFixedArray and ExtractFixedArray correctly
transition COW to non-COW maps when doing a clone requiring copying.

Bug:  chromium:775888 
Change-Id: I31c97072761fdd2360d86f840c9fd6ab2d72973a
Reviewed-on: https://chromium-review.googlesource.com/727900
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48754}
[modify] https://crrev.com/0454a842d143ae260d920f54bc2f8278aff9b186/src/builtins/builtins-constructor-gen.cc
[modify] https://crrev.com/0454a842d143ae260d920f54bc2f8278aff9b186/src/builtins/builtins-internal-gen.cc
[modify] https://crrev.com/0454a842d143ae260d920f54bc2f8278aff9b186/src/builtins/builtins-promise-gen.cc
[modify] https://crrev.com/0454a842d143ae260d920f54bc2f8278aff9b186/src/builtins/builtins-regexp-gen.cc
[modify] https://crrev.com/0454a842d143ae260d920f54bc2f8278aff9b186/src/code-stub-assembler.cc
[modify] https://crrev.com/0454a842d143ae260d920f54bc2f8278aff9b186/src/code-stub-assembler.h
[modify] https://crrev.com/0454a842d143ae260d920f54bc2f8278aff9b186/test/cctest/test-code-stub-assembler.cc
[add] https://crrev.com/0454a842d143ae260d920f54bc2f8278aff9b186/test/mjsunit/regress/regress-775888.js

ClusterFuzz has detected this issue as fixed in range 48753:48754.

Detailed report: https://clusterfuzz.com/testcase?key=5525304222416896

Fuzzer: ochang_js_fuzzer
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  array->map() != fixed_cow_array_map() in heap.cc
  v8::internal::Heap::MoveElements
  v8::internal::FastElementsAccessor<v8::internal::FastPackedObjectElementsAccesso
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=48623:48624
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=48753:48754

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5525304222416896

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5525304222416896 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot