Bisects to df2578d2ec630ccd08619e1f733da3f61e7ee380, reproduces as follows ...

$ ./out/x64.debug/d8 ~/Downloads/ClusterFuzz/6138000586309632/mutant7533_regress-599089-array-push.js

 Issue 676964  has been merged into this issue.

Daniel, there's a crash dump attached to the ticket I just dup'd into this one - if you need it.

 Issue 677741  has been merged into this issue.

 Issue 671131  has been merged into this issue.

 Issue 677642  has been merged into this issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/fcffcba72581ea338e13f79f57df758449093179

commit fcffcba72581ea338e13f79f57df758449093179
Author: danno <danno@chromium.org>
Date: Wed Jan 04 10:57:26 2017

Fix empty push bug in Array.push

BUG= chromium:670981 
LOG=N
R=ishell@chromium.org

Review-Url: https://codereview.chromium.org/2609973002
Cr-Commit-Position: refs/heads/master@{#42064}

[modify] https://crrev.com/fcffcba72581ea338e13f79f57df758449093179/src/code-stub-assembler.cc
[add] https://crrev.com/fcffcba72581ea338e13f79f57df758449093179/test/mjsunit/regress/regress-670981-array-push.js

ClusterFuzz has detected this issue as fixed in range 42057:42067.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6138000586309632

Fuzzer: decoder_langfuzz
Job Type: linux_asan_chrome_v8_d8
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  v8::internal::JSObject::AddDataElement
  v8::internal::Object::SetProperty
  v8::internal::Runtime::SetObjectProperty
  
Sanitizer: address (ASAN)

Regressed: V8: r41366:41371
Fixed: V8: r42057:42067

Minimized Testcase (6.92 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95ExJik2RqJ2F0mSm3Aw141ao5H7KGO_j_D4dzAjMmiPV7pLQnLz9PToueW04DxW2v4zTRSUSXZKX6Zz2CSRNGpbgHGTaZflxY1NykNmHWAuFpDBM8iqx-fAaPpHoFbLnK1MWr96cKOtaiXOGxaJVGFM4piGg?testcase_id=6138000586309632

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

 Issue 676172  has been merged into this issue.

 Issue 670157  has been merged into this issue.

 Issue 678552  has been merged into this issue.