Bug in i18n code. Simplified repro is ...

new Intl.DateTimeFormat('en-US', {'timeZone': true})

I am working on a fix ...

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/8226c88b52b8534745228aa0d1c2e822fd14f18d

commit 8226c88b52b8534745228aa0d1c2e822fd14f18d
Author: mstarzinger <mstarzinger@chromium.org>
Date: Thu Jul 14 11:31:08 2016

[i18n] Ensure [[ToString]] conversion of time zone names.

This adds a missing conversion of time zone names to string primitives
before case conversion and regular expression matching are applied.

This is in sync with ECMA-402, section 12.1.1.1, step 16(a).

R=jochen@chromium.org
TEST=mjsunit/regress/regress-crbug-627935
BUG= chromium:627935 

Review-Url: https://codereview.chromium.org/2143003005
Cr-Commit-Position: refs/heads/master@{#37757}

[modify] https://crrev.com/8226c88b52b8534745228aa0d1c2e822fd14f18d/src/js/i18n.js
[add] https://crrev.com/8226c88b52b8534745228aa0d1c2e822fd14f18d/test/mjsunit/regress/regress-crbug-627935.js

ClusterFuzz has detected this issue as fixed in range 37756:37757.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5923315483148288

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_v8_mipsel_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  args[0]->IsString() in runtime-strings.cc
  
Regressed: V8: r37703:37704
Fixed: V8: r37756:37757

Minimized Testcase (6.10 Kb): https://cluster-fuzz.appspot.com/download/AMIfv944waGUnOw_SM_rUl0Eo5t-8VkzyYV74d_LKN4j1x6anbBNEdnMtlYf6vusP53wK4DkrzbDX2F46ws1r62zDtkdjyNZ0uJg-ob1eaognAjOJFLurE2qqOZDdP19UYvVBKxZ1UjdPpIn1mRh2gUCVAadeuRFOw?testcase_id=5923315483148288

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

 Issue 628361  has been merged into this issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot