Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/501127995efd9e8ff4be11e2e6927a3e10597fd1 ([typedarrays] Reduce overheads of TA.p.set).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

This crash is triggered only when the given array's length is zero, so I think this is not a security issue. Even though it triggers a wrong type casting, it operates nothing. it is fixed by returning function when the given array length is zero.

WIP CL (https://chromium-review.googlesource.com/c/v8/v8/+/727448) will fix this issue.

Agreed this is not a security issue

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/6241e81c35125aa3e95a0fc83cca6c0131e7695e

commit 6241e81c35125aa3e95a0fc83cca6c0131e7695e
Author: Choongwoo Han <cwhan.tunz@gmail.com>
Date: Mon Oct 23 10:34:11 2017

[typedarrays] Fix a wrong type casting in TA.p.set

- Fix a wrong type casting triggered when a given array's length is zero
- Add a regression test case

Bug:  chromium:777182 ,  chromium:768775 
Change-Id: I615b73e9d7bad657c872c96c7a204efe355d8289
Reviewed-on: https://chromium-review.googlesource.com/732865
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48821}
[modify] https://crrev.com/6241e81c35125aa3e95a0fc83cca6c0131e7695e/src/elements.cc
[add] https://crrev.com/6241e81c35125aa3e95a0fc83cca6c0131e7695e/test/mjsunit/es6/regress/regress-777182.js

ClusterFuzz has detected this issue as fixed in range 48820:48821.

Detailed report: https://clusterfuzz.com/testcase?key=5021611463016448

Fuzzer: ochang_js_fuzzer
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !v8::internal::FLAG_enable_slow_asserts || (object->IsFixedDoubleArray()) in obj
  cast
  TryCopyElementsHandleFastNumber
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=48722:48723
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=48820:48821

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5021611463016448

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5021611463016448 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot