Assigning to jarin@ since it bisects to his recent CL changing state values.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/da2529ada02cc608b8e06598d72717637892df74

commit da2529ada02cc608b8e06598d72717637892df74
Author: jarin <jarin@chromium.org>
Date: Wed Dec 07 08:31:12 2016

[turbofan] Fix skipping of translations for lazy deopt return value stores.

BUG= chromium:671574 

Review-Url: https://codereview.chromium.org/2560743002
Cr-Commit-Position: refs/heads/master@{#41541}

[modify] https://crrev.com/da2529ada02cc608b8e06598d72717637892df74/src/compiler/code-generator.cc
[add] https://crrev.com/da2529ada02cc608b8e06598d72717637892df74/test/mjsunit/compiler/regress-671574.js

ClusterFuzz has detected this issue as fixed in range 41540:41541.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4769449321431040

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  false in code-generator.cc
  
Regressed: V8: r41468:41469
Fixed: V8: r41540:41541

Minimized Testcase (0.20 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95rfVXlQt9sfXxx-VQc4br_5-bmFkDh617TRjswanKByogSioo63KW3jzx1nzSouW4ONNSKQInSTk7kIwxp1fg5i6nKDeeS_7ybJblIe6oH-mKMjkHPRub3h8-Bqs4QcKub8H7ORPeWmxVFFU8kXNUQ7pI6QA?testcase_id=4769449321431040
"use strict";
  for (var __v_1 = 0; __v_1 < 1000000; __v_1++);
try {
try {
   eval('--');
} catch (e) {
}
} catch(e) {; }
try {
function get() { return x; }
__v_7 = {x: 1};
} catch(e) {"Caught: " + e; }


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.