Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/eeb583d8b89f954efd94ab884b4207187e5b9cc7 ([array] Move Array.p.fill to C++).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/4a6a631b5db32fb256bf5cd80b4adaff0ca57124

commit 4a6a631b5db32fb256bf5cd80b4adaff0ca57124
Author: Simon Zünd <szuend@google.com>
Date: Thu Jul 19 06:53:11 2018

[array] Use Array.p.fill baseline version if object is non-extensible

This CL fixes a bug where a fast-path was used on non-extensible
objects.

R=jgruber@chromium.org

Bug:  chromium:865264 , chromium:865285 
Change-Id: Ie14c95b383a65576799c71576a5c0f9f8e1c29ca
Reviewed-on: https://chromium-review.googlesource.com/1142766
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#54539}
[modify] https://crrev.com/4a6a631b5db32fb256bf5cd80b4adaff0ca57124/src/builtins/builtins-array.cc
[modify] https://crrev.com/4a6a631b5db32fb256bf5cd80b4adaff0ca57124/test/mjsunit/es6/array-fill.js

ClusterFuzz has detected this issue as fixed in range 54538:54539.

Detailed report: https://clusterfuzz.com/testcase?key=6568723507576832

Fuzzer: mbarbella_js_mutation
Job Type: linux_ubsan_vptr_d8
Platform Id: linux

Crash Type: Ill
Crash Address: 0x560aaca9d1de
Crash State:
  v8::internal::DictionaryElementsAccessor::CopyElementsImpl
  v8::internal::ElementsAccessorBase<v8::internal::DictionaryElementsAccessor, v8:
  v8::internal::ElementsAccessorBase<v8::internal::DictionaryElementsAccessor, v8:
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_d8&range=54521:54522
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_d8&range=54538:54539

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6568723507576832

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6568723507576832 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.