It does not seem to be a ignition specific bug. I can reproduce the same problem without ignition flag. adding Yang who may know more about regexp.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/93135d8c0d43ada3ac267bc8a5f6032079f8ae3b

commit 93135d8c0d43ada3ac267bc8a5f6032079f8ae3b
Author: yangguo <yangguo@chromium.org>
Date: Thu Apr 14 14:43:29 2016

[regexp] fix assertion failure when parsing close to stack overflow.

R=jkummerow@chromium.org
BUG= chromium:600257 
LOG=N

Review URL: https://codereview.chromium.org/1884143002

Cr-Commit-Position: refs/heads/master@{#35496}

[modify] https://crrev.com/93135d8c0d43ada3ac267bc8a5f6032079f8ae3b/src/regexp/regexp-parser.cc
[add] https://crrev.com/93135d8c0d43ada3ac267bc8a5f6032079f8ae3b/test/mjsunit/regress/regress-crbug-600257.js

ClusterFuzz has detected this issue as fixed in range 35495:35496.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5534859807686656

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  unicode() in src/regexp/regexp-parser.cc
  
Fixed: V8: r35495:35496

Minimized Testcase (9.81 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97JOiTVGKRq5eEIVIA5S_6bGkAvgc0GvxkdaDR1Jk4oRV67onVZTkDiRbifsVpc1FdXwGR1t2OlYcZ2atXyReKBzCHhMC21RTLKGVaPQSOB2Q8SSdd-7nRQOWl-P8lKPFn4tHoVrepH6f14XRpIx6B3Fz7caA

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

 Issue 596391  has been merged into this issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot