Unsure why this is not failing on the bots, but it fails for me consistently.
Can others repro?

/work/src/v8/v8/out.gn/x64.debug/d8 --test --random-seed=-180037141 --turbo --nohard-abort --nodead-code-elimination --nofold-constants --enable-slow-asserts --debug-code --verify-heap --expose-wasm /work/src/v8/v8/test/mjsunit/mjsunit.js /work/src/v8/v8/test/mjsunit/wasm/wasm-functions.js
=== mjsunit/wasm/wasm-functions ===                    
#
# Fatal error in ../../src/objects.cc, line 8976
# Check failed: memcmp(fresh->address(), new_map->address(), Map::kCodeCacheOffset) == 0.
#

==== C stack trace ===============================

    /work/src/v8/v8/out.gn/x64.debug/./libv8_libbase.so(v8::base::debug::StackTrace::StackTrace()+0x1e) [0x7fcf14ccc7be]
    /work/src/v8/v8/out.gn/x64.debug/./libv8_libbase.so(V8_Fatal+0x1c4) [0x7fcf14cc4814]
    /work/src/v8/v8/out.gn/x64.debug/./libv8.so(v8::internal::Map::Normalize(v8::internal::Handle<v8::internal::Map>, v8::internal::PropertyNormalizationMode, char const*)+0x432) [0x7fcf13e865c2]
    /work/src/v8/v8/out.gn/x64.debug/./libv8.so(v8::internal::Map::TransitionToAccessorProperty(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Map>, v8::internal::Handle<v8::internal::Name>, int, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, v8::internal::PropertyAttributes)+0x5b3) [0x7fcf13e95e03]
    /work/src/v8/v8/out.gn/x64.debug/./libv8.so(v8::internal::LookupIterator::TransitionToAccessorProperty(v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, v8::internal::PropertyAttributes)+0x2aa) [0x7fcf13e3824a]
    /work/src/v8/v8/out.gn/x64.debug/./libv8.so(v8::internal::JSObject::DefineAccessor(v8::internal::LookupIterator*, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, v8::internal::PropertyAttributes)+0x323) [0x7fcf13e8d443]
    /work/src/v8/v8/out.gn/x64.debug/./libv8.so(v8::internal::JSReceiver::ValidateAndApplyPropertyDescriptor(v8::internal::Isolate*, v8::internal::LookupIterator*, bool, v8::internal::PropertyDescriptor*, v8::internal::PropertyDescriptor*, v8::internal::Object::ShouldThrow, v8::internal::Handle<v8::internal::Name>)+0x17e5) [0x7fcf13e8d005]
    /work/src/v8/v8/out.gn/x64.debug/./libv8.so(v8::internal::JSReceiver::OrdinaryDefineOwnProperty(v8::internal::LookupIterator*, v8::internal::PropertyDescriptor*, v8::internal::Object::ShouldThrow)+0x12a) [0x7fcf13e8b60a]
    /work/src/v8/v8/out.gn/x64.debug/./libv8.so(v8::internal::JSReceiver::OrdinaryDefineOwnProperty(v8::internal::Isolate*, v8::internal::Handle<v8::internal::JSObject>, v8::internal::Handle<v8::internal::Object>, v8::internal::PropertyDescriptor*, v8::internal::Object::ShouldThrow)+0x49a) [0x7fcf13e8ae0a]
    /work/src/v8/v8/out.gn/x64.debug/./libv8.so(v8::internal::JSReceiver::DefineOwnProperty(v8::internal::Isolate*, v8::internal::Handle<v8::internal::JSReceiver>, v8::internal::Handle<v8::internal::Object>, v8::internal::PropertyDescriptor*, v8::internal::Object::ShouldThrow)+0x13f) [0x7fcf13e8051f]
    /work/src/v8/v8/out.gn/x64.debug/./libv8.so(+0x792a15) [0x7fcf13706a15]
    /work/src/v8/v8/out.gn/x64.debug/./libv8.so(+0x78c154) [0x7fcf13700154]
    /work/src/v8/v8/out.gn/x64.debug/./libv8.so(v8::internal::Builtin_ObjectDefineGetter(int, v8::internal::Object**, v8::internal::Isolate*)+0xe6) [0x7fcf136fff66]
    [0x35ebfea04167]
Received signal 6