Just filing this bug for documentation purposes. The crash no longer reproduces after:

commit a5c6676b136457266e8e10bf3f7df30a5184aa3b
Author: jarin <jarin@chromium.org>
Date:   Thu Apr 28 11:58:55 2016 -0700

    Unship try-catch and try-finally optimizations in Turbofan.
    
    Try catch interacts badly with OSR and for-in.
    
    BUG= chromium:607493 
    LOG=n
    
    Review-Url: https://codereview.chromium.org/1931973002
    Cr-Commit-Position: refs/heads/master@{#35877}

ClusterFuzz has detected this issue as fixed in range 390610:390616.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6614873168936960

Fuzzer: decoder_langfuzz
Job Type: linux_ubsan_vptr_d8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  RepresentationChangerError: node #8:Dead of kMachNone (Any) cannot be changed to
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_vptr_d8&range=389884:390111
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_vptr_d8&range=390610:390616

Minimized Testcase (8.91 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96xf1S3lF3H_LBsnQEPPcQ99qWtMiC5Ok61ZDyEBP1MjBVWBODdoHTaQzIioQVsdpsLPtpyP2dkJ-4Q0mqytv2PG0_FZ30Jo2lZzWu_z8xPSSXS6_wKom2Mu-_e4evZvdDqpiptpkFHzjtBsiy6bLwUCoWqyg

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot