Seems to be KeyAccumulator-related (https://codereview.chromium.org/1944703002):

#
# Fatal error in ../src/handles.cc, line 17
# Check failed: (location_) != nullptr.
#

==== C stack trace ===============================

 1: V8_Fatal
 2: v8::internal::HandleBase::IsDereferenceAllowed(v8::internal::HandleBase::DereferenceCheckMode) const
 3: v8::internal::HandleBase::operator*() const
 4: v8::internal::Handle<v8::internal::OrderedHashSet>::operator*() const
 5: v8::internal::Handle<v8::internal::OrderedHashSet>::operator->() const
 6: v8::internal::KeyAccumulator::GetKeys(v8::internal::GetKeysConversion)
 7: v8::internal::JSReceiver::GetKeys(v8::internal::Handle<v8::internal::JSReceiver>, v8::internal::KeyCollectionType, v8::internal::PropertyFilter, v8::internal::GetKeysConversion, bool)
 8: v8::internal::FastKeyAccumulator::GetKeysSlow(v8::internal::GetKeysConversion)
 9: v8::internal::FastKeyAccumulator::GetKeys(v8::internal::GetKeysConversion)
10: 0x17edaeb
11: 0x17ebff8

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6266573525876736

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_chrome_v8_d8
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  v8::internal::KeyAccumulator::GetKeys
  v8::internal::JSReceiver::GetKeys
  v8::internal::FastKeyAccumulator::GetKeysSlow
  
Regressed: V8: r36067:36085

Minimized Testcase (0.23 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95zPaeRXBZM6rN8oUad-OcePIyGBZhllU3WBM_fYnQUfaty7NRl7o2eHANSNq5INj-wpcB2LV1k2iVSa-jwghH7o1Len7bOe-90wgnFdFaJpan8zJc18fN-co9YeYgjXrZTWSVXGMoWCqghmx-CpwifA2h8Og
var __v_22 = function() {};
__v_27 = {
  get: function() {
  },
  ownKeys: function() {
    return ['toJSON'];
  }}
__v_28 = new Proxy({}, __v_27);
__v_32 = new Proxy(__v_28, __v_22);
for (var __v_28 in __v_32);
__v_39 = function() {
};


Filer: pucchakayala

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/da16609c1479240c0c4cf102321b9c553218184d

commit da16609c1479240c0c4cf102321b9c553218184d
Author: cbruni <cbruni@chromium.org>
Date: Tue May 10 14:26:21 2016

[keys] fixing nested JSProxy for-in enumeration

BUG= chromium:610210 
LOG=N

Review-Url: https://codereview.chromium.org/1963633002
Cr-Commit-Position: refs/heads/master@{#36144}

[modify] https://crrev.com/da16609c1479240c0c4cf102321b9c553218184d/src/keys.cc
[modify] https://crrev.com/da16609c1479240c0c4cf102321b9c553218184d/src/keys.h
[modify] https://crrev.com/da16609c1479240c0c4cf102321b9c553218184d/test/mjsunit/es6/proxies-for.js
[modify] https://crrev.com/da16609c1479240c0c4cf102321b9c553218184d/test/mjsunit/es6/proxies-keys.js

ClusterFuzz has detected this issue as fixed in range 36143:36144.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5915636311523328

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  (location_) != nullptr in src/handles.cc
  
Regressed: V8: r36072:36073
Fixed: V8: r36143:36144

Minimized Testcase (0.18 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95SXf_Gkh-BnXy25dhrduQQdgzkIe6UHwztDMwUbBrFOFohj13e6qYPYUA5N93MYMg7xwW6ak6G-As1NDMempWOCZAvHduZfZYlarWJneD8YyY1UmwyUSaC_hnclnDo1SWIpBz2RntmbZk7w0C-eWlijIN3ig
var __v_32 = {};
__v_1 = {
}
__v_7 = {
  ownKeys: function() {
    return [ 'c'];
  }
}
__v_8 = new Proxy({}, __v_7);
__v_23 = new Proxy(__v_8, __v_32);
for (var __v_28 in __v_23);


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot