Cleaned up repro ...

// Flags: --expose-gc --allow-natives-syntax --ignition-staging --no-lazy

function f() {
  for (var i = 0; i < 80000; i++);
  function g() {}
  %OptimizeFunctionOnNextCall(g);
  g();
}
f();
gc();
gc();
gc();
gc();
f();

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/8ab555cc15cb0095ba16ab9394a93e9e620e8e3a

commit 8ab555cc15cb0095ba16ab9394a93e9e620e8e3a
Author: mstarzinger <mstarzinger@chromium.org>
Date: Thu Aug 18 10:42:30 2016

[interpreter] Fix canonicalization when preserving bytecode.

This fixes canonicalization of {SharedFunctionInfo} objects in the
{Compiler::GetSharedFunctionInfo} method when bytecode is preserved.
Eager compilation is only triggered when no code is present.

R=rmcilroy@chromium.org
TEST=mjsunit/regress/regress-crbug-638551
BUG= chromium:638551 

Review-Url: https://codereview.chromium.org/2245263006
Cr-Commit-Position: refs/heads/master@{#38709}

[modify] https://crrev.com/8ab555cc15cb0095ba16ab9394a93e9e620e8e3a/src/compiler.cc
[add] https://crrev.com/8ab555cc15cb0095ba16ab9394a93e9e620e8e3a/test/mjsunit/regress/regress-crbug-638551.js

ClusterFuzz has detected this issue as fixed in range 38708:38709.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5295296630489088

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !shared->HasBytecodeArray() in compiler.cc
  
Regressed: V8: r38647:38648
Fixed: V8: r38708:38709

Minimized Testcase (0.33 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96CeqkQechfWJCM63egtvhinYqH0naPek1W9WeGg0YSwxBZhYgl59-jsqobwiOAVb-Mf7LxESsogUmmuFPAbQFLotP2CQe_0iHQ5RBxjT1KCFrfGU_65QB3H8FeGDUQe5ZnLbPNmXci1REhylw-qw19K2BYHw?testcase_id=5295296630489088
function __f_1() {
  for (var __v_1 = 0; __v_1 < 80000; __v_1++) {
  }
  function __f_2() {
  }
  var __v_2 = 0x80000000;
  %OptimizeFunctionOnNextCall(__f_2);
 __f_2();
}
__f_1();
__v_3 = []
    for (var __v_5 = 0; __v_5 < 5; ++__v_5) {
      __v_3.push(66)
    }
try {
} catch(e) {; }
  for (var __v_4 in __v_3) {
    gc();
  }
    __f_1();


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot