Regression range points to c0ded71713e6eea7e317a56f9a15b874fb89a083.

 Issue 651003  has been merged into this issue.

 Issue 650970  has been merged into this issue.

 Issue 650580  has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/fecd09ce32596c3fedf8cdf324f1314428752ff2

commit fecd09ce32596c3fedf8cdf324f1314428752ff2
Author: verwaest <verwaest@chromium.org>
Date: Thu Sep 29 13:29:04 2016

Readd default function variables upon scope reset for preparse abort

BUG= chromium:651327 

Review-Url: https://codereview.chromium.org/2380993003
Cr-Commit-Position: refs/heads/master@{#39864}

[modify] https://crrev.com/fecd09ce32596c3fedf8cdf324f1314428752ff2/src/ast/scopes.cc
[modify] https://crrev.com/fecd09ce32596c3fedf8cdf324f1314428752ff2/src/ast/scopes.h
[modify] https://crrev.com/fecd09ce32596c3fedf8cdf324f1314428752ff2/src/parsing/parser-base.h
[modify] https://crrev.com/fecd09ce32596c3fedf8cdf324f1314428752ff2/src/parsing/parser.cc
[add] https://crrev.com/fecd09ce32596c3fedf8cdf324f1314428752ff2/test/mjsunit/regress/regress-651327.js

ClusterFuzz has detected this issue as fixed in range 39863:39864.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6089175839539200

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  *isolate->global_object() == *receiver in ic.cc
  
Regressed: V8: r39768:39769
Fixed: V8: r39863:39864

Minimized Testcase (1.92 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94SebxL1Gt1IcQDjOT_avBd1RXjqGw3HSa5x1pHaloteJ-pxYV6yjMBgJjCBwy5Yq_A8YTMiN22MsLgh0-FYQbd1B0r5YE0yE2IV6IHZqOqMLlCP1_YkZBobwmGc0zpi08fByLflFa3ODaPYWnsGux4PP67hg?testcase_id=6089175839539200

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

 Issue 651582  has been merged into this issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot