might be a suspected cl 
https://chromium.googlesource.com/v8/v8/+/7a61bbcfd8b1bee2617b32e23a6bbf63cfbc00b3%5E%21/src/compiler/verifier.cc

jarin@ could you please look into this.please feel free to re-assigned back if needed. thanks in advance 

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/6646d73b6f387e7ef6add056cc022b6dafe03d36

commit 6646d73b6f387e7ef6add056cc022b6dafe03d36
Author: bmeurer <bmeurer@chromium.org>
Date: Wed Aug 24 11:09:20 2016

[turbofan] Use ObjectIsReceiver directly for inlining.

Don't bother using %_IsJSReceiver, which immediately gets lowered to
ObjectIsReceiver anyways (by the JSIntrinsicLowering), but requires
some complicated rewiring of effect/control chains.

R=mstarzinger@chromium.org
BUG= chromium:640369 

Review-Url: https://codereview.chromium.org/2271973003
Cr-Commit-Position: refs/heads/master@{#38864}

[modify] https://crrev.com/6646d73b6f387e7ef6add056cc022b6dafe03d36/src/compiler/js-inlining.cc
[modify] https://crrev.com/6646d73b6f387e7ef6add056cc022b6dafe03d36/src/compiler/js-inlining.h
[add] https://crrev.com/6646d73b6f387e7ef6add056cc022b6dafe03d36/test/mjsunit/regress/regress-crbug-640369.js

ClusterFuzz has detected this issue as fixed in range 38863:38864.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5114377424601088

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  IrOpcode::kLoop == loop->opcode() in verifier.cc
  
Regressed: V8: r38819:38820
Fixed: V8: r38863:38864

Minimized Testcase (1.52 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97J0YHWfuTVRWpq2QHDIxP3930w9rpuQe946cXqye_F_bI7vTzIq9Hg9zy1cWVOH9EixynJPqkq7DlOLRcs6uggY5LQ7D1K46LGGPl3_TEQMQHFb_pUeMNFFJDQtPHuFKLfBsfa7tGkQROc-93BRq8hlWekPQ?testcase_id=5114377424601088

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot