ClusterFuzz has detected this issue as fixed in range 34876:34877.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5714510479884288

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_mipsel_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  1 == BoolToInt(is_var) + BoolToInt(is_const) + BoolToInt(is_function) in src/run
  
Regressed: V8: r34846:34847
Fixed: V8: r34876:34877

Minimized Testcase (7.06 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97lT1XuriMMspg-WpQRmuolLInxSAWo64yxyEboTIKwV9JJ0I950VrETlVTOeVpF1g0y0ZfBOlmXcTW3b8_hTs1uQH9F7VMLmpZ2qzmgv0Uy3eDiqVHLkw9oLzgQw0GG2hlh0-jdydR6Fkm5PQksXOAXt8rcw

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Perform RegisterReservationsForBlackAllocation atomically with deserialization of code.

BUG= 596057 
LOG=n

Committed: https://crrev.com/08edc78b5ad773d18d66802b22322e12a32392c6
Cr-Commit-Position: refs/heads/master@{#34934}

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot