The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/9fdacb9e554e2b1ba235d9bb8e7f5cd8ee653883

commit 9fdacb9e554e2b1ba235d9bb8e7f5cd8ee653883
Author: jarin <jarin@chromium.org>
Date: Mon Jul 04 08:42:24 2016

[turbofan] Better handling of empty type in simplified lowering.

The re-typer now only types a node if its inputs are all typed with the
exception of phi nodes. This works because all cycles in the graph have
to contain a phi node.

BUG= chromium:625558 

Review-Url: https://codereview.chromium.org/2120243002
Cr-Commit-Position: refs/heads/master@{#37493}

[modify] https://crrev.com/9fdacb9e554e2b1ba235d9bb8e7f5cd8ee653883/src/compiler/operation-typer.cc
[modify] https://crrev.com/9fdacb9e554e2b1ba235d9bb8e7f5cd8ee653883/src/compiler/simplified-lowering.cc
[add] https://crrev.com/9fdacb9e554e2b1ba235d9bb8e7f5cd8ee653883/test/mjsunit/compiler/regress-625558.js
[modify] https://crrev.com/9fdacb9e554e2b1ba235d9bb8e7f5cd8ee653883/test/mjsunit/mjsunit.status

ClusterFuzz has detected this issue as fixed in range 37489:37497.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4636439010869248

Fuzzer: mbarbella_js_mutation
Job Type: linux_v8_d8_be
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !type->Is(Type::None()) in simplified-lowering.cc
  
Fixed: V8: r37489:37497

Minimized Testcase (0.11 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94VE8rc_h96XIiw5RHzLLMi5Eor1hDM3lB-fdzCQU4XCVKcD3DHhMRkX5PuZ-YKBS9axh5LN-F5sQEjpDYFdz1ZOputXE9HLOAzhb8C9_mKx3Quo9UJ0RUiYGTw1pbuRsUuwC3trsrjoqSMXtb78baM7oJ7DQ?testcase_id=4636439010869248
for (var __v_1 = 0; __v_1 <= 256; __v_1++) {
}
function __f_3() {
  __v_1 = "luft";
  __v_1 += ++__v_1;
}
__f_3();


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot