The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/477495c886f09d21487482b687e9ffbf8332f453

commit 477495c886f09d21487482b687e9ffbf8332f453
Author: rmcilroy <rmcilroy@chromium.org>
Date: Thu Aug 18 08:15:31 2016

[Parser] Track ContainsDot for SMI values.

Ensures SMI values have SMI type even if they have a dot (e.g., 1.0).
Adds SMI_WITH_DOT type to maintain this.

BUG= chromium:638134 

Review-Url: https://codereview.chromium.org/2248693005
Cr-Commit-Position: refs/heads/master@{#38698}

[modify] https://crrev.com/477495c886f09d21487482b687e9ffbf8332f453/src/ast/ast-value-factory.cc
[modify] https://crrev.com/477495c886f09d21487482b687e9ffbf8332f453/src/ast/ast-value-factory.h
[modify] https://crrev.com/477495c886f09d21487482b687e9ffbf8332f453/test/cctest/interpreter/bytecode_expectations/PrimitiveReturnStatements.golden
[modify] https://crrev.com/477495c886f09d21487482b687e9ffbf8332f453/test/cctest/interpreter/bytecode_expectations/UnaryOperators.golden
[add] https://crrev.com/477495c886f09d21487482b687e9ffbf8332f453/test/mjsunit/regress/regress-638134.js

ClusterFuzz has detected this issue as fixed in range 38697:38698.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4520534492839936

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_ignition_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  slice->AllElementsAreUnique() in constant-array-builder.cc
  
Regressed: V8: r38549:38550
Fixed: V8: r38697:38698

Minimized Testcase (7.17 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94sauwZ7zLMBDzefWlWyT_cP9nSyVL8ArD7mK-hPm9yOahCk0PNaJ1c2zGgkp5cillNivs2VZKqExyUF8M5MGN3KD8Ar482F8FXBEDjczoMti_gbMk9ivsp26J0vowMIlWCez4nveED63Rg379DaNMWOh4Y5A?testcase_id=4520534492839936

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot