# Different case with a reference error. Please check if it's the same root cause:
function getRandomProperty(v) {
  var properties = Object.getOwnPropertyNames(v);
  var proto = Object.getPrototypeOf(v);
  if (properties.length == 0) { return "0"; }
  properties[undefined];
}
var a = {};
function foo() {
  getRandomProperty(a)
  a.__defineSetter__(0, function() { });
  return boom();
}
function bar() {
  try {
    foo();
  } catch (e) {
  }
}
bar();
%OptimizeFunctionOnNextCall(bar);
bar();

# Compared default with ignition_staging

# Flags of default:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --gc-interval=446 --no-fold-constants --random-seed -1974816673
# Flags of ignition_staging:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --gc-interval=446 --no-fold-constants --random-seed -1974816673 --ignition-staging

Difference:
Different total output lines: 0 vs. 8

### Start of configuration default:

### End of configuration default

### Start of configuration ignition_staging:
out10_ignition_staging/fuzz-10802.js.minimized:11: ReferenceError: boom is not defined
  return boom();
  ^
ReferenceError: boom is not defined
    at foo (out10_ignition_staging/fuzz-10802.js.minimized:11:3)
    at bar (out10_ignition_staging/fuzz-10802.js.minimized:15:5)
    at out10_ignition_staging/fuzz-10802.js.minimized:21:1


### End of configuration ignition_staging

# Aaand another one. Please check again if same root cause:
for (var __v_12 = 0; __v_12 < 1000000; __v_12++);
function foo() {
  undefined.toString();
}
try {
  foo();
} catch(e) { print("Meh"); }
foo();


# Compared default with ignition_staging

# Flags of default:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit  --random-seed 422463981
# Flags of ignition_staging:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit  --random-seed 422463981 --ignition-staging

Difference:
Different total output lines: 8 vs. 7

### Start of configuration default:
Meh
out10_ignition_staging/fuzz-36380.js.minimized:3: TypeError: Cannot read property 'toString' of undefined
  undefined.toString();
           ^
TypeError: Cannot read property 'toString' of undefined
    at foo (out10_ignition_staging/fuzz-36380.js.minimized:3:12)
    at out10_ignition_staging/fuzz-36380.js.minimized:8:1


### End of configuration default

### Start of configuration ignition_staging:
out10_ignition_staging/fuzz-36380.js.minimized:3: TypeError: Cannot read property 'toString' of undefined
  undefined.toString();
           ^
TypeError: Cannot read property 'toString' of undefined
    at foo (out10_ignition_staging/fuzz-36380.js.minimized:3:12)
    at out10_ignition_staging/fuzz-36380.js.minimized:6:3


### End of configuration ignition_staging

# More:
for (var i = 0; i < 100000; i++) { }
function foo() {
  Object.defineProperty();
}
try {
  foo();
} catch(e) {; }
gc();

All most likely the same as  issue 660379 , which I am working on already.

These look to be fixed now that Michi's fix to 660379 has landed.