Suspected CL
https://chromium.googlesource.com/v8/v8/+/f23985d767f3a2517f881dc740446dc8be2438c6%5E%21/src/objects.cc

bmeurer@, could you please take a look and reassign if it is not related your changes.

Thank you

Please don't guess owners; use bisection results or assign clusterfuzz issues according to the clusterfuzz rotation (see go/v8) if it looks like a V8 issues. According to the regression range it doesn't even contain any V8 commits.

Sure, thank you.

Unable to find possible suspects from find or CL.
Using Code Search for the file, "receiver->IsJSFunction() in objects.cc" adding few related Devs in Cc.
Could some one please look into the issue and update.
Thank You.

The clusterfuzz report looks like it's related to PromiseContext.

Assigning to myself.

ClusterFuzz has detected this issue as fixed in range 444307:444338.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5664309213659136

Fuzzer: inferno_layout_test_unmodified
Job Type: mac_asan_chrome
Platform Id: mac

Crash Type: CHECK failure
Crash Address: 
Crash State:
  receiver->IsJSFunction() in objects.cc
  
Sanitizer: address (ASAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=436239:436251
Fixed: https://cluster-fuzz.appspot.com/revisions?job=mac_asan_chrome&range=444307:444338

Minimized Testcase (2.46 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96P0mAWdL7g8eOMaWkPZXOJ6wi2eg4a5YMVYSd9CXhDS1ts0R5Xkugr5_hpIuszHpmSfJ45lSiAdk5Rrd54LkUtw1T0TKgMWI0MvzGZoprxXYn_8FUYmuaoKycPhy6_kyyhXbyz21wJAzkFkdcrFlrX-pR1ug?testcase_id=5664309213659136

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5664309213659136 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.