Reproduces on TOT.

There are two issues here:
1) Abort: Operand is not a smi. Investigating...
2) Assertion failure during JS call stack printing. This issue was introduced by https://codereview.chromium.org/1696043002.

out/x64.debug/d8 --debug-code test.js

===== test.js =====
function load(a, i) {
  return a[i];
}

function f2() {
  return load(new Proxy({}, {})) ;
}

f2();
f2();
load([11, 22, 33], 0);
f2();

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/28113880e317acdb374372b6dac101a46458fa46

commit 28113880e317acdb374372b6dac101a46458fa46
Author: ishell <ishell@chromium.org>
Date: Tue Apr 19 08:56:53 2016

Fix polymorphic keyed load handler selection for proxies.

BUG= chromium:603463 
LOG=N

Review URL: https://codereview.chromium.org/1894203002

Cr-Commit-Position: refs/heads/master@{#35607}

[modify] https://crrev.com/28113880e317acdb374372b6dac101a46458fa46/src/ic/ic.cc
[add] https://crrev.com/28113880e317acdb374372b6dac101a46458fa46/test/mjsunit/regress/regress-crbug-603463.js

The fix mentioned in c#4 addresses "1) Abort: Operand is not a smi."

Moving this nonessential bug to the next milestone.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot