The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4

commit ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4
Author: ishell <ishell@chromium.org>
Date: Fri Apr 01 07:22:22 2016

[crankshaft] [turbofan] Fix environment handling when generating a tail call from inlined function.

This CL ensures that we build environments/frame states so that tail caller frame will never become topmost.

BUG= chromium:598998 , v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1849503002

Cr-Commit-Position: refs/heads/master@{#35188}

[modify] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/src/compiler/instruction-selector.cc
[modify] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/src/crankshaft/arm/lithium-arm.cc
[modify] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/src/crankshaft/arm64/lithium-arm64.cc
[modify] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/src/crankshaft/ia32/lithium-ia32.cc
[modify] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/src/crankshaft/mips/lithium-mips.cc
[modify] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/src/crankshaft/mips64/lithium-mips64.cc
[modify] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/src/crankshaft/ppc/lithium-ppc.cc
[modify] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/src/crankshaft/s390/lithium-s390.cc
[modify] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/src/crankshaft/x64/lithium-x64.cc
[modify] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/src/crankshaft/x87/lithium-x87.cc
[add] https://crrev.com/ecb8fcfcca4c35a32a8c10bf63dd090bdc5424c4/test/mjsunit/regress/regress-crbug-598998.js

ClusterFuzz has detected this issue as fixed in range 35252:35253.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6464973873610752

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  output_count_ - 1 != frame_index in src/deoptimizer.cc
  
Regressed: V8: r34991:34992
Fixed: V8: r35252:35253

Minimized Testcase (11.50 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94GX59EdK5thr41V1QwxN1jrP-GxY54icAqbcGqhScj9aOhgBrmg-Dzhx0DjpQEEsvciVhHBOUuKQkNG2DxqMa8joFcvL8KPihzsZNxPFzZdLX0rCF9NfZ-Xl7TE9L9yaDel1hiXd9TKkfq8V76EjKp0BRWoA

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot