Reproduces as follows ...

$ git checkout b143cb09d04d3f408893e8272fe78c64b1b8f2bb
$ make -j1000 x64.debug
$ ./out/x64.debug/d8 --enable-slow-asserts --omit-quit --gc-interval=337 --stress-compaction -e ""

 Issue 641237  has been merged into this issue.

Issue is a loop that's not using handles causing a GC. Fix on the way.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/2059fb0ba6d76e00b51c0651a2af554dea44319f

commit 2059fb0ba6d76e00b51c0651a2af554dea44319f
Author: mlippautz <mlippautz@chromium.org>
Date: Fri Aug 26 12:35:40 2016

[api] Use handle for ConfigureInstance

BUG= chromium:641267 
R=verwaest@chromium.org

Review-Url: https://codereview.chromium.org/2283713002
Cr-Commit-Position: refs/heads/master@{#38942}

[modify] https://crrev.com/2059fb0ba6d76e00b51c0651a2af554dea44319f/src/api-natives.cc

ClusterFuzz has detected this issue as fixed in range 38941:38942.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6004993553596416

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_arm64_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !v8::internal::FLAG_enable_slow_asserts || (object->IsFunctionTemplateInfo()) in
  
Regressed: V8: r38915:38916
Fixed: V8: r38941:38942

Minimized Testcase (0.00 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94AXdt0khObvCJB-BK4DZaNLXc0jpH1vFzg1LWsNikWgNmszQT2AmXnwKsGs_goK2MYMEUHCsK1p3bQAJq30Ed87-ugkRENRjmIPcDmTNv8faDcC4HUZnQkNFbE6W89BHpbLBzITRruCN81614vXgnxS-EqDA?testcase_id=6004993553596416

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot