The fix for this will have to be merged into our 5.6 branch (assuming it's an observable issue).

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/4513532f6362353eaf50ec30d753a346e795b164

commit 4513532f6362353eaf50ec30d753a346e795b164
Author: ishell <ishell@chromium.org>
Date: Mon Nov 21 11:21:30 2016

[ic] Don't check full prototype chain if name is a private symbol.

BUG= chromium:664974 ,  chromium:664802 , v8:5561

Review-Url: https://codereview.chromium.org/2513893003
Cr-Commit-Position: refs/heads/master@{#41133}

[modify] https://crrev.com/4513532f6362353eaf50ec30d753a346e795b164/src/ic/ic.cc
[modify] https://crrev.com/4513532f6362353eaf50ec30d753a346e795b164/src/prototype.h
[add] https://crrev.com/4513532f6362353eaf50ec30d753a346e795b164/test/mjsunit/regress/regress-crbug-664802.js
[add] https://crrev.com/4513532f6362353eaf50ec30d753a346e795b164/test/mjsunit/regress/regress-crbug-664974.js

[Auto-generated comment by a script] We noticed that this issue is targeted for M-56; it appears the fix may have landed after branch point, meaning a merge might be required. Please confirm if a merge is required here - if so add Merge-Request-56 label, otherwise remove Merge-TBD label. Thanks.

ClusterFuzz has detected this issue as fixed in range 41132:41133.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5170464453558272

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_ignition_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  NameDictionary::kNotFound == current->property_dictionary()->FindEntry(name) in 
  
Regressed: V8: r40945:40946
Fixed: V8: r41132:41133

Minimized Testcase (6.70 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94kDc4GT7eGUcfZOFGY8_5w1hYEgwv3EOmfGh74EDw7BwX6YoO726qx6yOOI3whmBHheVZFL34OHMIhqjeD6SAKO43tTn83ClbYiHnza7iJI9AHVRdVcjCxF6Pz_LdHerwN9CK9PiWhrFuh-25Fv2VwY7wd8Q?testcase_id=5170464453558272

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Any merge required in V8 branch? If not please remove Merge-TBD label.

Merging is required. I'll merge it back once I get approval for  issue 665886 .

Your change meets the bar and is auto-approved for M56 (branch: 2924)

Thanks for the update in #10.

FYI: M56 Beta promotion is scheduled on Dec 6 & RC cut on Monday, Dec 5 @ 4.00 PM PST.Please ensure to verify the fix and merge your change ASAP so that we could take it for next Release.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/8feaaa256e6e36aad210467d808001bc26471e98

commit 8feaaa256e6e36aad210467d808001bc26471e98
Author: ishell@chromium.org <ishell@chromium.org>
Date: Mon Dec 05 12:47:56 2016

Merged: Squashed multiple commits.

Merged: [ic] Invalidate prototype validity cell when a slow prototype becomes fast.
Revision: f718cd1309be2327d1d218560f8663f8b165e4fa

Merged: [ic] Don't check full prototype chain if name is a private symbol.
Revision: 4513532f6362353eaf50ec30d753a346e795b164

BUG= chromium:664802 , chromium:664974 , chromium:665886 ,v8:5561
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/2554503002 .

Cr-Commit-Position: refs/branch-heads/5.6@{#32}
Cr-Branched-From: bdd3886218dfe76e8560eb8a18401942452ae859-refs/heads/5.6.326@{#1}
Cr-Branched-From: 879f6599eee6e1dfcbe9a24bf688b261c03e9558-refs/heads/master@{#41014}

[modify] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/src/factory.cc
[modify] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/src/ic/ic.cc
[modify] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/src/objects.cc
[modify] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/src/objects.h
[modify] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/src/prototype.h
[add] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/test/mjsunit/regress/regress-crbug-664802.js
[add] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/test/mjsunit/regress/regress-crbug-664974.js
[add] https://crrev.com/8feaaa256e6e36aad210467d808001bc26471e98/test/mjsunit/regress/regress-crbug-665886.js

This bug requires manual review: No test file found in commits.
Please contact the milestone owner if you have questions.
Owners: amineer@(clank), cmasso@(bling), gkihumba@(cros), bustamante@(desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug requires manual review: No test file found in commits.
Please contact the milestone owner if you have questions.
Owners: amineer@(clank), cmasso@(bling), gkihumba@(cros), bustamante@(desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

[Automated comment] removing mislabelled Merge-Review-56, Hotlist-Merge-Review