The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/3218ef30b8c8fe6622ec8d03b634a7fd992ef5af

commit 3218ef30b8c8fe6622ec8d03b634a7fd992ef5af
Author: jarin <jarin@chromium.org>
Date: Mon Sep 26 11:44:49 2016

[turbofan] Fix restriction type for modulus in representation inference.

BUG= chromium:650215 

Review-Url: https://codereview.chromium.org/2373453002
Cr-Commit-Position: refs/heads/master@{#39715}

[modify] https://crrev.com/3218ef30b8c8fe6622ec8d03b634a7fd992ef5af/src/compiler/simplified-lowering.cc
[add] https://crrev.com/3218ef30b8c8fe6622ec8d03b634a7fd992ef5af/test/mjsunit/compiler/regress-650215.js

ClusterFuzz has detected this issue as fixed in range 39709:39716.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6611836910960640

Fuzzer: mbarbella_js_mutation
Job Type: linux_v8_d8_tot
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  restriction_type->Is(info->restriction_type()) in simplified-lowering.cc
  
Regressed: V8: r38265:38290
Fixed: V8: r39709:39716

Minimized Testcase (0.13 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95lfgcmJ1aROWRbBlLxx9EPd_k_Je146PE_NIXX7-MohAR9MAdgBtOuHIDutWHKGtyDvWTpseuDP3HVGtg3gESuWK02TgRRacoWOHLwQyIlrK2tsG93OEKkWyakvvK86_VVv4cWLDd-dSQjJdsWrQekKLrwnA?testcase_id=6611836910960640
var __v_0 = {};
function __f_2() {
  var __v_2 = 0;
  for (var __v_1 = -1; __v_2 <= 0; ++__v_0) __v_1 = (2 % __v_1) | 0;
}
__f_2();


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot