Regression range points to ca0c951a7e8888cc57fb2837763550a1ae300796.

Note that it requires --verify-heap to reproduce.

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Igor, friendly ping from security sheriff. This is High severity issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/00a781dbc3a2499fa198279db4eeb0519c2b65b9

commit 00a781dbc3a2499fa198279db4eeb0519c2b65b9
Author: Igor Sheludko <ishell@chromium.org>
Date: Wed Nov 22 16:51:47 2017

[runtime] Ensure elements transitions don't interfere with field type tracking.

This CL ensures that elements kind transitions don't cause silent
mutable-to-constant or any-to-class-type migrations of in-place
generalizable fields.

Bug: v8:5495,  chromium:783132 
Change-Id: Ie60224db62bd45d27148ae0469c7af5a3fe944fd
Reviewed-on: https://chromium-review.googlesource.com/785190
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49583}
[modify] https://crrev.com/00a781dbc3a2499fa198279db4eeb0519c2b65b9/src/api-natives.cc
[modify] https://crrev.com/00a781dbc3a2499fa198279db4eeb0519c2b65b9/src/bootstrapper.cc
[modify] https://crrev.com/00a781dbc3a2499fa198279db4eeb0519c2b65b9/src/heap/heap.cc
[modify] https://crrev.com/00a781dbc3a2499fa198279db4eeb0519c2b65b9/src/heap/setup-heap-internal.cc
[modify] https://crrev.com/00a781dbc3a2499fa198279db4eeb0519c2b65b9/src/map-updater.cc
[modify] https://crrev.com/00a781dbc3a2499fa198279db4eeb0519c2b65b9/src/objects-debug.cc
[modify] https://crrev.com/00a781dbc3a2499fa198279db4eeb0519c2b65b9/src/objects.cc
[modify] https://crrev.com/00a781dbc3a2499fa198279db4eeb0519c2b65b9/src/objects/map-inl.h
[modify] https://crrev.com/00a781dbc3a2499fa198279db4eeb0519c2b65b9/src/objects/map.h
[modify] https://crrev.com/00a781dbc3a2499fa198279db4eeb0519c2b65b9/test/cctest/test-field-type-tracking.cc
[add] https://crrev.com/00a781dbc3a2499fa198279db4eeb0519c2b65b9/test/mjsunit/regress/regress-crbug-783132.js
[modify] https://crrev.com/00a781dbc3a2499fa198279db4eeb0519c2b65b9/test/mjsunit/unbox-double-arrays.js

This bug requires manual review: We are only 12 days from stable.
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), gkihumba@(ChromeOS), govind@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

+awhalley@ for M63 merge review

ClusterFuzz has detected this issue as fixed in range 49582:49583.

Detailed report: https://clusterfuzz.com/testcase?key=5811474495963136

Fuzzer: ochang_js_fuzzer
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  is_transitionable_fast_elements_kind implies !Map::IsInplaceGeneralizableField(d
  v8::internal::JSObject::JSObjectVerify
  v8::internal::JSArray::JSArrayVerify
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=49132:49133
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=49582:49583

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5811474495963136

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5811474495963136 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Merge approved! Please make sure to verify the fix after merging it into M63 branch 3239

Letting +awhalley@ approved this instead.

This bug requires manual review: We are only 7 days from stable.
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), gkihumba@(ChromeOS), govind@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

cmasso@ - OK to take.

Approving merge to M63 branch 3239 based on  comment #19. Pls merge your change to M63 branch 3239 before 12:30 PM, Tuesday (11/28/17) so we can take it in for this week last Beta release. Thank you.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/39e9f33a60c109f70ca5ed2f14e5e1a877f062ba

commit 39e9f33a60c109f70ca5ed2f14e5e1a877f062ba
Author: ishell@chromium.org <ishell@chromium.org>
Date: Tue Nov 28 19:01:18 2017

Merged: Squashed multiple commits.

Merged: [runtime] Prepare for turning constant field tracking on.
Revision: ca0c951a7e8888cc57fb2837763550a1ae300796

Merged: [runtime] Ensure elements transitions don't interfere with field type tracking.
Revision: 00a781dbc3a2499fa198279db4eeb0519c2b65b9

BUG= chromium:783132 ,v8:5495,v8:6980
TBR=cbruni@chromium.org
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Change-Id: I1a78e876649d04a4b9be5ebd04d59a8e2e6a3563
Reviewed-on: https://chromium-review.googlesource.com/793735
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.3@{#93}
Cr-Branched-From: 094a7c93dcdcd921de3883ba4674b7e1a0feffbe-refs/heads/6.3.292@{#1}
Cr-Branched-From: 18b8fbb528a8021e04a029e06eafee50b918bce0-refs/heads/master@{#48432}
[modify] https://crrev.com/39e9f33a60c109f70ca5ed2f14e5e1a877f062ba/src/api-natives.cc
[modify] https://crrev.com/39e9f33a60c109f70ca5ed2f14e5e1a877f062ba/src/bootstrapper.cc
[modify] https://crrev.com/39e9f33a60c109f70ca5ed2f14e5e1a877f062ba/src/factory.cc
[modify] https://crrev.com/39e9f33a60c109f70ca5ed2f14e5e1a877f062ba/src/heap/heap.cc
[modify] https://crrev.com/39e9f33a60c109f70ca5ed2f14e5e1a877f062ba/src/heap/setup-heap-internal.cc
[modify] https://crrev.com/39e9f33a60c109f70ca5ed2f14e5e1a877f062ba/src/lookup.cc
[modify] https://crrev.com/39e9f33a60c109f70ca5ed2f14e5e1a877f062ba/src/map-updater.cc
[modify] https://crrev.com/39e9f33a60c109f70ca5ed2f14e5e1a877f062ba/src/map-updater.h
[modify] https://crrev.com/39e9f33a60c109f70ca5ed2f14e5e1a877f062ba/src/objects-debug.cc
[modify] https://crrev.com/39e9f33a60c109f70ca5ed2f14e5e1a877f062ba/src/objects.cc
[modify] https://crrev.com/39e9f33a60c109f70ca5ed2f14e5e1a877f062ba/src/objects/map-inl.h
[modify] https://crrev.com/39e9f33a60c109f70ca5ed2f14e5e1a877f062ba/src/objects/map.h
[modify] https://crrev.com/39e9f33a60c109f70ca5ed2f14e5e1a877f062ba/test/cctest/test-field-type-tracking.cc
[add] https://crrev.com/39e9f33a60c109f70ca5ed2f14e5e1a877f062ba/test/mjsunit/regress/regress-crbug-783132.js
[modify] https://crrev.com/39e9f33a60c109f70ca5ed2f14e5e1a877f062ba/test/mjsunit/unbox-double-arrays.js

Thank you for merging to M63. If nothing is pending, please remove "Merge-Approved-63" label.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot