The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/4a6a0f553061cc4a6543d683fe07040c19c77d24

commit 4a6a0f553061cc4a6543d683fe07040c19c77d24
Author: verwaest <verwaest@chromium.org>
Date: Thu Apr 21 11:16:42 2016

Make sure we always try to make prototypes fast again when transitioning accessors

BUG= chromium:605060 
LOG=n

Review URL: https://codereview.chromium.org/1907953002

Cr-Commit-Position: refs/heads/master@{#35697}

[modify] https://crrev.com/4a6a0f553061cc4a6543d683fe07040c19c77d24/src/lookup.cc
[add] https://crrev.com/4a6a0f553061cc4a6543d683fe07040c19c77d24/test/mjsunit/regress/regress-crbug-605060.js

Awesome, thanks for fixing.

ClusterFuzz has detected this issue as fixed in range 35680:35701.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6549156729978880

Fuzzer: mbarbella_js_mutation_test262
Job Type: linux_v8_d8_tot
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  map->is_stable() in v8/src/compilation-dependencies.cc
  
Regressed: V8: r34206:34211
Fixed: V8: r35680:35701

Minimized Testcase (1.19 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95YirSNj36QeikmszQyarkQItmZA8ep24MNymzaa0KWgITxp0p-2YMysO1IRzPLtiGaV94WmlkKLZ7RiEAXnrvDSe6T5_X902NTGQI4gfqjjerxCr4GW8Cch_vPlfCJXIJX5YMvBeBb5fW47b75pfWTvBRZDg

Additional requirements: Requires Gestures

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot