looks this is the suspected cl:

https://chromium.googlesource.com/v8/v8/+/e5ac75c6354f6dbe0fbe217f857750ab9fb0bd45%5E%21/src/interpreter/bytecode-array-writer.cc

rmcilroy @ could you please look into this.please feel free to re-assigned back if needed. thanks in advance !

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/2c9b5844f982172aaa978563b557275fdf82f8c2

commit 2c9b5844f982172aaa978563b557275fdf82f8c2
Author: rmcilroy <rmcilroy@chromium.org>
Date: Fri Oct 07 14:54:58 2016

[Interpreter] Remove an invalid DCHECK.

A wide jump can be patched with a non-wide jump target operand, so the
DCHECK added in r39637 was wrong.

BUG= chromium:652430 

Review-Url: https://codereview.chromium.org/2400203002
Cr-Commit-Position: refs/heads/master@{#40090}

[modify] https://crrev.com/2c9b5844f982172aaa978563b557275fdf82f8c2/src/interpreter/bytecode-array-writer.cc

ClusterFuzz has detected this issue as fixed in range 40089:40090.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6614848094076928

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  Bytecodes::SizeForUnsignedOperand(static_cast<uint32_t>(entry)) == OperandSize::
  
Regressed: V8: r39636:39637
Fixed: V8: r40089:40090

Minimized Testcase (0.47 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv9679NktmO-pZ19j4N5kGq9SY18u6RQJlU3e83vmEYioEE209ub0mN1eeYorsd_t7oxz36JCbhyRdC-c5GKuLeWk0LlI-Ri4MVt_v1GlSXOXuJfx392Rm5FX9E36545gMfx3KxSphLb-jAf6H4SgJMXAoxujug?testcase_id=6614848094076928
try {
( {
}());
} catch(e) {; }
function __f_19(length) {
  var __v_9 = "(function () {\n" +
            "  for (var __v_8 = 0; __v_8 <= " + length + "; __v_8++) {\n" +
            "    switch(__v_8) {\n";
  for (var __v_8 = 0; __v_8 < length; __v_8++) {
    __v_9 += "    case " + __v_8 + ": __v_9 += 2; break;\n";
  }
  __v_9 += "    default: __v_9 += 1;\n" +
         "    }\n" +
         "  }\n" +
         "})";
  return eval(__v_9);
}
__v_7 = 2838;
__v_10 = __f_19(__v_7);


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot