Bisects to: https://crrev.com/9211dee01abc9e8dee16cb0915fc9673132823af

Will post repro instructions in a jiffy ...

Reproduces as follows ...

$ ./out/x64.debug/d8 mutant5302_regress-fast-empty-string.js
$ cat mutant5302_regress-fast-empty-string.js
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

try {
  Error.prepareStackTrace = function(e, frames) {
    for (var anonymous in caller) {
      delete escape[1];
    }
  }
  throw 23;
} catch(e) {
}

var o = {};
o[""] = (true  );
var x = {__proto__:o};
for (i = 0; i < 3; i++) {
  Error.captureStackTrace(x);
}

ClusterFuzz has detected this issue as fixed in range 37968:37969.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5730914932097024

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !isolate->has_pending_exception() in objects.cc
  
Regressed: V8: r37907:37908
Fixed: V8: r37968:37969

Minimized Testcase (7.89 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94U-uMGSBHal2hgBZ9mFHIMSfN_JLMzhNVapp-nbckuk1qwAvoYQveGxWF0FDehSMcA7XaehK6hcNoEA8GRSvvb7Rf0OIjWSMvonZeftndOTe1cQuXQoX-01nICrzsHaHQFo13L0ZOMFTETcLyVWua_8B-CHQ?testcase_id=5730914932097024

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot