Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/8bef26522ced3a48eaf586ca8b717cd15c922327 ([heap] Add a CodePageCollectionMemoryModificationScope to collect unprotected code pages on the fly.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

 Issue 819373  has been merged into this issue.

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

ClusterFuzz has detected this issue as fixed in range 51879:51880.

Detailed report: https://clusterfuzz.com/testcase?key=5677170803081216

Fuzzer: decoder_langfuzz
Job Type: linux_ubsan_vptr_d8
Platform Id: linux

Crash Type: UNKNOWN WRITE
Crash Address: 0x3d5e0c558450
Crash State:
  next
  SearchForNodeInList
  SearchForNodeInList
  
Sanitizer: undefined (UBSAN)

Recommended Security Severity: High

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_d8&range=51764:51765
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_d8&range=51879:51880

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5677170803081216

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5677170803081216 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This was trunk churn and was hit by ochang_js_fuzzer the same day.

This bug requires manual review: M66 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), josafat@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

hpayer@ - does anything need to be merged?

Nothing to be merged, trunk churn.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot