ClusterFuzz has detected this issue as fixed in range 35153:35154.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6074653411377152

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_mipsel_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  maybe_context->IsContext() in src/deoptimizer.cc
  
Regressed: V8: r35138:35139
Fixed: V8: r35153:35154

Minimized Testcase (0.26 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97aLDSXwai9I7q-riwyVyniePdlXm6buyCsquGX3WxuvvgIpcaQkNGWGzsNW7FWwlrEl7MDYvNKn6fbyNgQipijrK4EqGToXw2-UoKsILEPTmNWN3CF_gbkZjo8huY39bk6sQYIwraKY4HTumqxZ0NKRENOUw
__v_6 = [ Float64Array ];
function __f_6() {
}
__v_8 = [
  function() { return 4.6; }];
for (var __v_9 of __v_6) {
  var __v_10 = new __v_9();
  __v_10.set({length: {valueOf: __f_6}});
  for (var __v_11 of __v_8) {
    __v_10.set({length: {valueOf: __v_11}});
  }
}


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot