The regression range seems bogus.

Reproduces on TOT, introduced by https://codereview.chromium.org/1843613002.

We are trying to deoptimize a code-stub builtin.

out/x64.debug/d8 --predictable --expose-gc --allow-natives-syntax --gc-interval=400  ~/Downloads/fuzz-01912.js --trace-deopt


===== test.js =====
for (var i = 0; i < 100; i++) {
  try {
    Object.prototype.valueOf.apply(null, [{}]);
  } catch (e) {
  }
  try {
    Object.prototype.hasOwnProperty.apply();
  } catch (e) {
  }
}

ClusterFuzz has detected this issue as fixed in range 35264:35265.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4770440723038208

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  topmost_optimized_code == NULL || safe_to_deopt || turbofanned in src/deoptimize
  
Regressed: V8: r35178:35179
Fixed: V8: r35264:35265

Minimized Testcase (4.59 Kb): https://cluster-fuzz.appspot.com/download/AMIfv948ol0ocv1Jicm7AM_k7U9HM_ljrqYfvmXK3_QYuaD9xN-gXy034zjPSgs7hZiBgCwbx5y8AC0VLgo-Hkhbnn81pTlA7gljkkbwMgn3gv2Q2ovPNs2MPR3X22khhARP5yTy5ePEx7u4tL-QKkyFlZmXFotafQ

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

commit 974721c66131d208571b8759a1caadf7f995c54c
Author: bmeurer <bmeurer@chromium.org>
Date:   Wed Apr 6 01:37:09 2016 -0700

    [generators] Decouple generator resume from fullcodegen.
    
    Introduce a ResumeGeneratorTrampoline, which does the actual stack state
    reconstruction (currently always restores a fullcodegen frame), and
    introduce appropriate TurboFan builtins for %GeneratorPrototype%.next,
    %GeneratorPrototype%.return and %GeneratorPrototype%.throw based on
    this native builtin.
    
    Also unify the flooding in case of step-in to always work based on
    JSFunction and remove the special casing for JSGeneratorObject.
    
    R=mstarzinger@chromium.org, neis@chromium.org
    TBR=rossberg@chromium.org
    BUG= chromium:513471 
    LOG=n
    
    Review URL: https://codereview.chromium.org/1865833002
    
    Cr-Commit-Position: refs/heads/master@{#35283}

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot