Regression range points to: https://chromium.googlesource.com/v8/v8/+/10b5febe11b318cfef130abae343183ac862e60d

It seems heap verification is borked on MIPS. Reproduces with the empty script as follows ...

$ git checkout 9e99c92c22125d01da4e478dc48dc87e1b3a07bc
$ make -j1000 mipsel.debug
$ ./out/mips.debug/d8 --verify-heap -e ""

#
# Fatal error in ../src/assembler.cc, line 918
# Check failed: code->address() == HeapObject::cast(found)->address().
#

==== C stack trace ===============================

 1: V8_Fatal
 2: v8::internal::RelocInfo::Verify(v8::internal::Isolate*)
 3: v8::internal::Code::CodeVerify()
 4: v8::internal::HeapObject::HeapObjectVerify()
 5: v8::internal::Object::ObjectVerify()
 6: v8::internal::PagedSpace::Verify(v8::internal::ObjectVisitor*)
 7: v8::internal::Heap::Verify()
 8: v8::internal::Heap::TearDown()
 9: v8::internal::Isolate::Deinit()
10: v8::internal::Isolate::TearDown()
11: v8::Isolate::Dispose()
12: v8::Shell::Main(int, char**)
13: main
14: __libc_start_main
Illegal instruction (core dumped)

ClusterFuzz has detected this issue as fixed in range 35595:35596.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4858235554627584

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_mipsel_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  code->address() == HeapObject::cast(found)->address() in src/assembler.cc
  
Regressed: V8: r35426:35427
Fixed: V8: r35595:35596

Minimized Testcase (0.00 Kb): https://cluster-fuzz.appspot.com/download/AMIfv978QPPtGb33rOOx0aL9CVeLL0s4F_bVspbg7svINwqx220Hf2E3Gt_iggFlnGRMxdVaBv5HY6HgEdHLVjKU74AabwCiEjeY_HTjpUAD6xbngPmqu3Cr8NjE_CGRa263EnQtUJqZwaBlRFUHaGYsRM8XmjN39g

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot