Regression range points to 7c73cf32c60484cdf37c84f1d61b4640e87068d7.

ClusterFuzz has detected this issue as fixed in range 39767:39768.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5055382009675776

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  old_target->kind() == new_target->kind() in objects-debug.cc
  
Regressed: V8: r39718:39719
Fixed: V8: r39767:39768

Minimized Testcase (5.69 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96HW-ibMDTLmzLvO21ZhlUIOiJPqb0AsgdQ32jOu1ycgCaTnV7ZzTkmrAuNH5Pgo5lsIB2T7bvvy0JSKAOF2r-VsG_MQxwK6OVv4nlW6PNoZel6ILMYzbu0LBvgeg1BOp1pyysWtrpehEMc7Vb63U_pxNpttg?testcase_id=5055382009675776

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Reproduces as follows ...

$ git checkout ccdfa302ba179cbd9faf6190a0eeabe08f4ad5c6
$ make -j1000 x64.debug
$ ./out/x64.debug/d8 ~/Downloads/ClusterFuzz/5055382009675776/mutant8441_regress-78270.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/22ff09e06a3c4e26e831be228355e93b81bd3ab1

commit 22ff09e06a3c4e26e831be228355e93b81bd3ab1
Author: marja <marja@chromium.org>
Date: Tue Oct 04 09:38:23 2016

PreParsing inner functions: Fix declaration-only variables.

If an inner function only declares a variable but doesn't use it, Parser
and PreParser produced different unresolved variables, and that confused
the pessimistic context allocation.

BUG= chromium:650969 

Review-Url: https://codereview.chromium.org/2388183003
Cr-Commit-Position: refs/heads/master@{#39947}

[modify] https://crrev.com/22ff09e06a3c4e26e831be228355e93b81bd3ab1/src/ast/scopes.cc
[modify] https://crrev.com/22ff09e06a3c4e26e831be228355e93b81bd3ab1/src/ast/scopes.h
[modify] https://crrev.com/22ff09e06a3c4e26e831be228355e93b81bd3ab1/src/parsing/preparser.cc
[modify] https://crrev.com/22ff09e06a3c4e26e831be228355e93b81bd3ab1/src/parsing/preparser.h
[modify] https://crrev.com/22ff09e06a3c4e26e831be228355e93b81bd3ab1/test/mjsunit/fixed-context-shapes-when-recompiling.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/e474e5ffc83cddc0cc1ff7cc9d247f90cd827bfd

commit e474e5ffc83cddc0cc1ff7cc9d247f90cd827bfd
Author: marja <marja@chromium.org>
Date: Mon Oct 10 09:22:22 2016

PreParsing inner functions: Fix declaration-only variables, part 2.

If an inner function only declares a variable but doesn't use it, Parser
and PreParser produced different unresolved variables, and that confused
the pessimistic context allocation.

This is continuation to https://codereview.chromium.org/2388183003/

This CL fixes more complicated declarations (which are not just one
identifier). For this, PreParser needs to accumulate identifiers used
in expressions.

In addition, this CL manifests FLAG_lazy_inner_functions in tests, so that
we get clusterfuzz coverage for it.

BUG= chromium:650969 ,  v8:5501 

Review-Url: https://codereview.chromium.org/2400613003
Cr-Commit-Position: refs/heads/master@{#40112}

[modify] https://crrev.com/e474e5ffc83cddc0cc1ff7cc9d247f90cd827bfd/src/ast/scopes.cc
[modify] https://crrev.com/e474e5ffc83cddc0cc1ff7cc9d247f90cd827bfd/src/parsing/parser.cc
[modify] https://crrev.com/e474e5ffc83cddc0cc1ff7cc9d247f90cd827bfd/src/parsing/preparser.cc
[modify] https://crrev.com/e474e5ffc83cddc0cc1ff7cc9d247f90cd827bfd/src/parsing/preparser.h
[modify] https://crrev.com/e474e5ffc83cddc0cc1ff7cc9d247f90cd827bfd/test/mjsunit/fixed-context-shapes-when-recompiling.js

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot