Benedikt, seems like your CL is the culprit.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/96f1327a93c4333aaf3d642866922e724113804e

commit 96f1327a93c4333aaf3d642866922e724113804e
Author: bmeurer <bmeurer@chromium.org>
Date: Mon Oct 17 05:40:42 2016

[turbofan] Add missing Float32 -> TaggedSigned conversion.

There are a couple of operators that can indeed produce Float32
representation, which we might end up using in a TaggedSigned
context, so add the missing conversion (indirectly via Float64).

BUG= chromium:656275 
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2421193002
Cr-Commit-Position: refs/heads/master@{#40334}

[modify] https://crrev.com/96f1327a93c4333aaf3d642866922e724113804e/src/compiler/representation-change.cc
[add] https://crrev.com/96f1327a93c4333aaf3d642866922e724113804e/test/mjsunit/regress/regress-crbug-656275.js

ClusterFuzz has detected this issue as fixed in range 40333:40334.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4841858700410880

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  NumberFround of kRepFloat32 (Number) cannot be changed to kRepTaggedSigned in re
  
Regressed: V8: r39653:39654
Fixed: V8: r40333:40334

Minimized Testcase (17.56 Kb): https://cluster-fuzz.appspot.com/download/AMIfv961h8Co5_6DmdP_O2LKwrEVMJGvb479jiT_kFCAXh0P5dZJjU-7d48_WKVfhyRVPZkzANov2EPaHpXDeP-pS3wuJVQvzRR8hgz5UdOJKxDgNH4DybL8MKC3ErjMo0sOJxZQhktsk-nGJmEEd8eRGZegWuUot7OZxJLKdLu7Jphj85LR8Gk?testcase_id=4841858700410880

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot