Bisects to: https://chromium.googlesource.com/v8/v8/+/ed60a76fbf9f4ffbf5f3ddd960a1654f7552199c

Benedikt, do you know someone to give this to while Jaro is on vacation?

Reproduces as follows ...

$ ./out/x64.debug/d8 --turbo --always-opt ~/Downloads/fuzz-01273.js 

#
# Fatal error in ../src/compiler/typer.cc, line 312
# Check failed: previous->Is(current).
#

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/b4f8a7c9006fb99f17217027e56d8e8113193636

commit b4f8a7c9006fb99f17217027e56d8e8113193636
Author: jarin <jarin@chromium.org>
Date: Thu Sep 08 03:50:43 2016

[turbofan] Ensure monotonicity for induction variable typing.

The trouble here is that the type of the induction variable might be
a bit ahead of the increment (JSAdd) operation's type. When we update
the type of the increment, we might only update the induction variable
type while the JSAdd type might be stale. If the induction variable typing
needs to fall back to normal phi typing (e.g., when the increment is not
an integer anymore), it might use the stale type.

To get around this, we fake monotonicity if we fallback to normal phi
typing. Another option would be to force re-typing of the increment
operation, but that seems to be harder to maintain.

BUG= chromium:644633 

Review-Url: https://codereview.chromium.org/2320803002
Cr-Commit-Position: refs/heads/master@{#39261}

[modify] https://crrev.com/b4f8a7c9006fb99f17217027e56d8e8113193636/src/compiler/typer.cc
[add] https://crrev.com/b4f8a7c9006fb99f17217027e56d8e8113193636/test/mjsunit/compiler/regress-644633.js

ClusterFuzz has detected this issue as fixed in range 39260:39264.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5489795461808128

Fuzzer: mbarbella_js_mutation
Job Type: linux_v8_d8_tot
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  previous->Is(current) in typer.cc
  
Regressed: V8: r38599:38625
Fixed: V8: r39260:39264

Minimized Testcase (0.22 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94wnAMGl2ecCj9uvhLcJ6-qoNywTSSS7zrIZg2aCPh67FqJl14NoVy-X09Oq32vNowEXDsCdye5RHb1zeozcC1yvLEPh76zO-zwDxWEbvaeFFBBwKRvlRxeBjq-k2flunkX0xfbrMiRX3MfpxPBKwL_z1lo1A?testcase_id=5489795461808128
var __v_13 = -1073741824;
function __f_1() {
  var __v_9 = __v_13;
  var __v_10 = __v_13*__v_13*__v_13*__v_13*__v_13*__v_13*__v_13;
  for (var __v_16 = -9; __v_9 < 1; __v_4++) {
    __v_9 += __v_9 * __v_10;
  }
}
  __f_1();


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot