Based on this issue "625590"

@ishell: Could you please look into this issue.

Thank you.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/fc66694de85bf26bb00a51cc21ab4c32770c1f56

commit fc66694de85bf26bb00a51cc21ab4c32770c1f56
Author: ishell <ishell@chromium.org>
Date: Thu Jul 28 14:28:06 2016

[fullcode][mips][mips64][ppc][s390] Avoid trashing of a home object when doing a count operation with keyed load/store to a super.

BUG= chromium:631917 

Review-Url: https://codereview.chromium.org/2191663004
Cr-Commit-Position: refs/heads/master@{#38139}

[modify] https://crrev.com/fc66694de85bf26bb00a51cc21ab4c32770c1f56/src/full-codegen/mips/full-codegen-mips.cc
[modify] https://crrev.com/fc66694de85bf26bb00a51cc21ab4c32770c1f56/src/full-codegen/mips64/full-codegen-mips64.cc
[modify] https://crrev.com/fc66694de85bf26bb00a51cc21ab4c32770c1f56/src/full-codegen/ppc/full-codegen-ppc.cc
[modify] https://crrev.com/fc66694de85bf26bb00a51cc21ab4c32770c1f56/src/full-codegen/s390/full-codegen-s390.cc
[add] https://crrev.com/fc66694de85bf26bb00a51cc21ab4c32770c1f56/test/mjsunit/regress/regress-crbug-631917.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/fc66694de85bf26bb00a51cc21ab4c32770c1f56

commit fc66694de85bf26bb00a51cc21ab4c32770c1f56
Author: ishell <ishell@chromium.org>
Date: Thu Jul 28 14:28:06 2016

[fullcode][mips][mips64][ppc][s390] Avoid trashing of a home object when doing a count operation with keyed load/store to a super.

BUG= chromium:631917 

Review-Url: https://codereview.chromium.org/2191663004
Cr-Commit-Position: refs/heads/master@{#38139}

[modify] https://crrev.com/fc66694de85bf26bb00a51cc21ab4c32770c1f56/src/full-codegen/mips/full-codegen-mips.cc
[modify] https://crrev.com/fc66694de85bf26bb00a51cc21ab4c32770c1f56/src/full-codegen/mips64/full-codegen-mips64.cc
[modify] https://crrev.com/fc66694de85bf26bb00a51cc21ab4c32770c1f56/src/full-codegen/ppc/full-codegen-ppc.cc
[modify] https://crrev.com/fc66694de85bf26bb00a51cc21ab4c32770c1f56/src/full-codegen/s390/full-codegen-s390.cc
[add] https://crrev.com/fc66694de85bf26bb00a51cc21ab4c32770c1f56/test/mjsunit/regress/regress-crbug-631917.js

ClusterFuzz has detected this issue as fixed in range 38138:38139.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6253425906155520

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_mipsel_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  args[1]->IsJSObject() in runtime-classes.cc
  
Regressed: V8: r34400:34401
Fixed: V8: r38138:38139

Minimized Testcase (0.59 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97jng-c911Hp2tUaFhAzA6ErjXuR5uw1C4S1KMdrRdrLBDO8ENZrRWKUivDqBIpjB9_tYDCgP3LOWFaDtjDlEQ7VUU3exjNXNOA4xoHMHWRw5Ku9J4O8HK8vq2GBDW9iIBb9svvvV2kV1MeLSANxt2R-PfCAA?testcase_id=6253425906155520

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot