Regression range points to 8e7426173b63a3090b880b7353911d8ba8501a12. Reproduces as follows ...

$ ./out/arm.debug/d8 ./test/mjsunit/mjsunit.js ~/Downloads/ClusterFuzz/6713942773858304/mutant3601_regress-469605b.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/10033749fdb0d2907295b572ab8c4abd8e118169

commit 10033749fdb0d2907295b572ab8c4abd8e118169
Author: bmeurer <bmeurer@chromium.org>
Date: Thu Nov 03 12:34:49 2016

[turbofan] CheckBounds cannot be used within asm.js.

Also properly deal with constant indices for String element access in
the JSNativeContextSpecialization.

BUG= chromium:661949 
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2474013002
Cr-Commit-Position: refs/heads/master@{#40723}

[modify] https://crrev.com/10033749fdb0d2907295b572ab8c4abd8e118169/src/compiler/js-native-context-specialization.cc
[modify] https://crrev.com/10033749fdb0d2907295b572ab8c4abd8e118169/src/compiler/node-matchers.h
[add] https://crrev.com/10033749fdb0d2907295b572ab8c4abd8e118169/test/mjsunit/regress/regress-crbug-661949.js

ClusterFuzz has detected this issue as fixed in range 40722:40723.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6713942773858304

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  We should never get here - unexpected deopt info in deoptimizer.cc
  
Regressed: V8: r40520:40521
Fixed: V8: r40722:40723

Minimized Testcase (5.90 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97xKu61t62wRYwrZzlWtL3EhtlpTtaipuzTbpJDoA-fQOQboEkTKv9gxZUpivG5kE1-f_SlsCDt8heHjcD4gjxy9vzMIDH_x1zCHvc4L1FLyI64wmkelWL_5PL4RzzwHdYfkhDNibgs1N1V9o9q4WpiwTXb_Q?testcase_id=6713942773858304

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot