Regression range points to 5784773feb92d06e76d4eb0fb93ed9496b9df30b.

I can't reproduce the crash in the builds I have, but I can identify some differences in the map of the @@iterator function, which might be responsible for the problem. I'll see if fixing the map corrects this

Reproduces as follows ...

$ git checkout 22606f0c29421d6a72e46595ec2995c7771ff070
$ make -j1000 x64.debug
$ ./out/x64.debug/d8 --ignition-staging ~/Downloads/fuzz-00212.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/8fea775784d340d899bdab6a0248bf5d4daf3f07

commit 8fea775784d340d899bdab6a0248bf5d4daf3f07
Author: caitp <caitp@igalia.com>
Date: Tue Sep 27 11:05:26 2016

[builtins] adapt arguments for Builtins::kIteratorPrototypeIterator

BUG= chromium:650172 
R=mstarzinger@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2368323002
Cr-Commit-Position: refs/heads/master@{#39760}

[modify] https://crrev.com/8fea775784d340d899bdab6a0248bf5d4daf3f07/src/bootstrapper.cc
[add] https://crrev.com/8fea775784d340d899bdab6a0248bf5d4daf3f07/test/mjsunit/es6/regress/regress-650172.js

ClusterFuzz has detected this issue as fixed in range 39759:39760.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6138160780410880

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: Stack-overflow
Crash Address: 0x7fffb29eb5f0
Crash State:
  v8::internal::Invoke
  v8::internal::Execution::Call
  v8::internal::Object::GetPropertyWithDefinedGetter
  
Regressed: V8: r39597:39598
Fixed: V8: r39759:39760

Minimized Testcase (0.63 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95VM-zXcJ1oYK6IGEQfrM7cTLHO1AGbzgyWKlupRtvHWWtipMotAQSMyPmOAD7il8EiPhXO3dtN9dWp8snQ97ZiDeTX3WrjRfv6WGJUpWTGZHNvq-z4avNkZ445pMkuQT9E2RfXRbqGf6igQXg0JMQro0xl2A?testcase_id=6138160780410880

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

 Issue 650984  has been merged into this issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot