Hooray! The new check fired :)

 Issue 821365  has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/dfe7eb84e300e3ae022c14d31909c19a27e75849

commit dfe7eb84e300e3ae022c14d31909c19a27e75849
Author: Eric Holk <eholk@chromium.org>
Date: Thu Mar 15 18:19:32 2018

Mark neteured ArrayBuffers as not neuterable

Bug:  chromium:821368 
Change-Id: I4e7032d76a0ac0e291b9dab2f7bcb58ce84827cf
Reviewed-on: https://chromium-review.googlesource.com/963601
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51971}
[modify] https://crrev.com/dfe7eb84e300e3ae022c14d31909c19a27e75849/src/objects.cc
[add] https://crrev.com/dfe7eb84e300e3ae022c14d31909c19a27e75849/test/mjsunit/regress/regress-821368.js

ClusterFuzz testcase 5813927259406336 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

ClusterFuzz has detected this issue as fixed in range 51970:51971.

Detailed report: https://clusterfuzz.com/testcase?key=6299918109769728

Fuzzer: ochang_js_fuzzer
Job Type: linux_ubsan_vptr_d8
Platform Id: linux

Crash Type: Ill
Crash Address: 0x5612cfbe91ee
Crash State:
  v8::internal::JSArrayBuffer::Neuter
  v8::ArrayBuffer::Neuter
  v8::Serializer::FinalizeTransfer
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_d8&range=51889:51890
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_d8&range=51970:51971

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6299918109769728

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.