Benedikt, it's yours.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/305948fa76c19679cbc1822a5d95b358d7561dd5

commit 305948fa76c19679cbc1822a5d95b358d7561dd5
Author: bmeurer <bmeurer@chromium.org>
Date: Thu Oct 27 12:16:01 2016

[ic] Properly deal with all oddballs when updating BinaryOpIC state.

R=jarin@chromium.org
BUG= chromium:659967 

Review-Url: https://codereview.chromium.org/2453633005
Cr-Commit-Position: refs/heads/master@{#40616}

[modify] https://crrev.com/305948fa76c19679cbc1822a5d95b358d7561dd5/src/ic/ic-state.cc
[add] https://crrev.com/305948fa76c19679cbc1822a5d95b358d7561dd5/test/mjsunit/regress/regress-crbug-659967.js

ClusterFuzz has detected this issue as fixed in range 40615:40616.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6211312783982592

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_v8_mipsel_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  right->IsUndefined(isolate_) || right->IsBoolean() in ic-state.cc
  
Regressed: V8: r40607:40608
Fixed: V8: r40615:40616

Minimized Testcase (10.49 Kb): https://cluster-fuzz.appspot.com/download/AMIfv966MABIPG2Cjx3jgVhyM-c_YDyLZg3LuuAcJRA29bcJ3-V6LN8q1onR_Y4_cl6a2x3EJCL5C251lxv1d-A0hOqvs5mNA08UeNmShqrw-UcGojb-2VLz_3p9a51T2_-jzhAJ1ArhIk2hZ8fAu4qNZ1ZViDntjw?testcase_id=6211312783982592

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot