Assigning to Yang, since it bisected to his recent CL. CC'ing bmeurer@ since the failure was in the js-builtin-reducer.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/a610155c8ced2933b801338d025c98617f423fd8

commit a610155c8ced2933b801338d025c98617f423fd8
Author: yangguo <yangguo@chromium.org>
Date: Tue Dec 06 13:09:38 2016

Fix assertion failure in JSBuiltinReducer::ReduceArrayIterator.

TBR=bmeurer@chromium.org
BUG= chromium:671576 

Review-Url: https://codereview.chromium.org/2550143004
Cr-Commit-Position: refs/heads/master@{#41518}

[modify] https://crrev.com/a610155c8ced2933b801338d025c98617f423fd8/src/contexts.h
[add] https://crrev.com/a610155c8ced2933b801338d025c98617f423fd8/test/mjsunit/regress/regress-crbug-671576.js

ClusterFuzz has detected this issue as fixed in range 41517:41518.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5936048069935104

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_mipsel_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  map_index >= Context::TYPED_ARRAY_KEY_ITERATOR_MAP_INDEX in js-builtin-reducer.c
  
Regressed: V8: r41495:41496
Fixed: V8: r41517:41518

Minimized Testcase (0.25 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97TDhx4dykZlPH2mp92eH4ungBVT3TkJ8u7mWY-81GB2SEUmyQC57zMN9Z-BwhdKHZtNJ0mAaFUMnXVhwZrFwsJ71z2nL1gl-QmGkVosoP5Do7JFBxH3xItAG-RS1TSOFo8MGIfmyijmF5jh_qJ4hzh5BFNnw?testcase_id=5936048069935104
(function __f_13() {
  function __f_5() {
    try {
__v_12;
    } catch (e) {
    __f_26();
    }
  }
 __f_5();
  %OptimizeFunctionOnNextCall(__f_5);
 __f_5();
})();
function __f_26() {
  var __v_20 = [ NaN];
  for (var __v_26 of __v_20.keys()) {
  }
}


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.