Regression range points to 7f21e67b38a859c5503777a606d68ef3cb449517.

ClusterFuzz has detected this issue as fixed in range 41117:41118.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6344024438079488

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  OperatorProperties::GetTotalInputCount(node->op()) == node->InputCount() in veri
  
Regressed: V8: r40969:40970
Fixed: V8: r41117:41118

Minimized Testcase (0.26 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96_zp1C8pXLaTBGxnVDg25nyfSRdb6Q8UAfJ_W-qw06nXwd1fgQd8MUlFfZBFXcTTre-e8ew9QwpIqNB_E2xSTnTa76NhiNsJTqP5SNiLpa-XE7vPSZ5ifVLCfKBBodomm1ltklo6HZRuv90wCWHOB2hY2LIQ?testcase_id=6344024438079488
(function __f_11() {
  function __f_3() {
    __f_23();
    try {
    } catch (e) {
    }
  }
 __f_3();
 __f_3();
  %OptimizeFunctionOnNextCall(__f_3);
 __f_3();
})();
( {
})();
function __f_23() {
  var __v_20 = [];
  var __v_21 = __v_20.entries();
[], __v_21.next();
}


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Your change meets the bar and is auto-approved for M56 (branch: 2924)

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/1ee743e9423c49a455ad48488b49e4b4494ed3ee

commit 1ee743e9423c49a455ad48488b49e4b4494ed3ee
Author: Benedikt Meurer <bmeurer@google.com>
Date: Mon Nov 21 05:23:09 2016

Merged: [builtins] add context input to users of CreateKeyValueArray opcode

Revision: e84f0adba9e5a06b15cf319b9c5c78a0fa86c551

BUG= chromium:666622 , v8:5388 
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=jarin@chromium.org

Review URL: https://codereview.chromium.org/2517053002 .

Cr-Commit-Position: refs/branch-heads/5.6@{#7}
Cr-Branched-From: bdd3886218dfe76e8560eb8a18401942452ae859-refs/heads/5.6.326@{#1}
Cr-Branched-From: 879f6599eee6e1dfcbe9a24bf688b261c03e9558-refs/heads/master@{#41014}

[modify] https://crrev.com/1ee743e9423c49a455ad48488b49e4b4494ed3ee/src/compiler/js-builtin-reducer.cc
[add] https://crrev.com/1ee743e9423c49a455ad48488b49e4b4494ed3ee/test/mjsunit/es6/regress/regress-666622.js

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot