The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/84dd29bb3c608e60d4fcd18d0250277e034e26a7

commit 84dd29bb3c608e60d4fcd18d0250277e034e26a7
Author: jkummerow <jkummerow@chromium.org>
Date: Wed Mar 16 10:55:08 2016

Fix polymorphic keyed load handler selection for string elements

The monomorphic case already carefully ensures that we don't try to use
a regular elements load stub on string wrapper elements. The polymorphic
path must perform an equivalent check.

BUG= chromium:594955 
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1806543002

Cr-Commit-Position: refs/heads/master@{#34807}

[modify] https://crrev.com/84dd29bb3c608e60d4fcd18d0250277e034e26a7/src/ic/ic.cc
[add] https://crrev.com/84dd29bb3c608e60d4fcd18d0250277e034e26a7/test/mjsunit/regress/regress-crbug-594955.js

ClusterFuzz has detected this issue as fixed in range 34806:34807.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6064989726572544

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  elements_kind == DICTIONARY_ELEMENTS in src/ic/handler-compiler.cc
  
Regressed: V8: r33615:33616
Fixed: V8: r34806:34807

Minimized Testcase (9.43 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96gyUFRFU1WOWJBOm-MPnQb6Akd5kBIxH_nEhzHmQMf8bL-TECfI8rBJEYWU1_PfW9EKFQ01_SGPKoo6d81rFPBXVnVvhKTyceg9DusCwNfbFUQvghRga4AZqp9gTMZ0BVrY97b7wuPVU78_6vYTqO18H_gbg

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot