The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/62801ee3a11d77b95b9ea110875a78e7afc11f7d

commit 62801ee3a11d77b95b9ea110875a78e7afc11f7d
Author: mythria <mythria@chromium.org>
Date: Fri Apr 15 14:49:31 2016

OptimizeFunctionOnNextCall and DeoptimizeFunction ignores calls on non-JSFunction objects.

Runtime_OptimizeFunctionOnNextCall and Runtime_DeoptimizeFunction asserts that
the argument is a JSFunction object.These are used by fuzzers to get coverage
of optimizations in compiler. Having an assert causes a fuzzer test to fail
when OptimizeFunctionOnNextCall is called on objects that are not functions.
We can instead, silently return on such calls.

BUG= chromium:601391 
LOG=N

Review URL: https://codereview.chromium.org/1883603002

Cr-Commit-Position: refs/heads/master@{#35539}

[modify] https://crrev.com/62801ee3a11d77b95b9ea110875a78e7afc11f7d/src/runtime/runtime-test.cc

ClusterFuzz has detected this issue as fixed in range 35538:35539.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4620917191213056

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: RUNTIME_ASSERT
Crash Address: 
Crash State:
  args[0]->IsJSFunction() in src/runtime/runtime-test.cc
  
Fixed: V8: r35538:35539

Minimized Testcase (0.06 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95fKt8TZVUpjnxhaYYF3VPTwWfcdq_5RjxjJ_x7XqjnZYrtlEAGCvAIqeXonR4Y9F2yxIiPqpWyYsP1LlOMv6JT3psNiGFDRI6mR_ZcLrDqil9_Rk1jXj--RilZiqcaXhWhRE9FiNWrL467SMFnEUWDe172Qg
%OptimizeFunctionOnNextCall(__f_8);
var __f_8 = ( {
})();


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot