ClusterFuzz has detected this issue as fixed in range 41716:41739.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4504684088000512

Fuzzer: mbarbella_js_mutation
Job Type: linux_v8_d8_tot
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  CanBeTaggedPointer(type.representation()) in code-generator.cc
  
Regressed: V8: r39653:39687
Fixed: V8: r41716:41739

Minimized Testcase (0.14 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94AKynOT-bDoNbWNxXPXJhXZ6cE3YxcEzGrPzjAekmdw5LBAjEAZ40ND6gg9q2e47TsaXp_KEfWWvAfaJdtqS-FXF1uVPenLNbE3ykNJ9pAQdKtyX8Cvj8yzgfp7ORGCfLOVH651L_R4vePnYMAyljDbIwsgA?testcase_id=4504684088000512
__v_4 = -1073741824;
__v_4 = 2;
function __f_3() {
  __v_4 = "a";
  __v_4 = __v_4;
  for (var __v_3 = __v_4; __v_3 < 2; __v_3++) {
  }
}
__f_3();


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4504684088000512 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.