Regression range points to: https://crrev.com/55f903500adc6c00aa6f13467f0d9a5b4d7f2d0f

Reproduces on tip-of-tree as follows ...

$ ./out/x64.debug/d8 --gc-interval=27 ~/Downloads/fuzz-00851.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/7ede61ed1da8f21bd4043e0d66ef86240cf0fe7c

commit 7ede61ed1da8f21bd4043e0d66ef86240cf0fe7c
Author: cbruni <cbruni@chromium.org>
Date: Sat Jul 23 12:13:32 2016

[elements] Omit fast path in PrependElementIndices

In PrependElementIndicesImpl we sort a FixedArray of indices potentially
containing HeapNumbers. During the string conversion we might trigger a GC.
This in turn might try to read a slot where we previously had a HeapNumber
but the sort sneaked a SMI in there which is not a valid pointer.

BUG= chromium:630561 

Review-Url: https://codereview.chromium.org/2173653003
Cr-Commit-Position: refs/heads/master@{#37993}

[modify] https://crrev.com/7ede61ed1da8f21bd4043e0d66ef86240cf0fe7c/src/elements.cc
[add] https://crrev.com/7ede61ed1da8f21bd4043e0d66ef86240cf0fe7c/test/mjsunit/regress/regress-crbug-630561.js

ClusterFuzz has detected this issue as fixed in range 37992:37993.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6669656538742784

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_ignition_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  collector->heap()->Contains(obj) in mark-compact.cc
  
Regressed: V8: r37931:37932
Fixed: V8: r37992:37993

Minimized Testcase (1.39 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94Z6AbLUpwxEK8iX27Nfp2LJ8U94OjJlngG4ba-9Ev92uOvu7ImY04ftqVLv3M78kmfwzxXi22rmKIJUxVZFU0bWt84JT6fImQQCLCtd_GVewyHRyWOUdD-1ekRX06keRfk2y6gV0XAUSXbkw2WdqFbMSqnug?testcase_id=6669656538742784

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot