Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/b590679496e829fd2f88ba4494072f0196c979de (Activate CSA implementation of Array.prototype.slice).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

 Issue 782073  has been merged into this issue.

 Issue 786084  has been merged into this issue.

Fix in flight: https://chromium-review.googlesource.com/c/v8/v8/+/776696

 Issue 786517  has been merged into this issue.

 Issue 786675  has been merged into this issue.

 Issue 786753  has been merged into this issue.

Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/f0ceb9f2774519299712392e76ab3606c294c17d

commit f0ceb9f2774519299712392e76ab3606c294c17d
Author: Daniel Clifford <danno@chromium.org>
Date: Mon Nov 20 11:53:13 2017

Fix bug in length handling of Array.prototype.slice fast-path

Bug:  chromium:785804 
Change-Id: I1a65e2007438ac009d961e0e2c0425212216fcf1
Reviewed-on: https://chromium-review.googlesource.com/776696
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49481}
[modify] https://crrev.com/f0ceb9f2774519299712392e76ab3606c294c17d/src/builtins/builtins-array-gen.cc
[add] https://crrev.com/f0ceb9f2774519299712392e76ab3606c294c17d/test/mjsunit/regress/regress-785804.js

ClusterFuzz has detected this issue as fixed in range 49480:49481.

Detailed report: https://clusterfuzz.com/testcase?key=5882233008422912

Fuzzer: ochang_js_fuzzer
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  !IsSmi() == Internals::HasHeapObjectTag(this) in objects.h
  IsHeapObject
  v8::internal::Object::VerifyPointer
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=48861:48862
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=49480:49481

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5882233008422912

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5882233008422912 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

 Issue 786791  has been merged into this issue.

 Issue 786890  has been merged into this issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot