Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5426162538119168

Fuzzer: mbarbella_js_mutation
Job Type: linux_ubsan_vptr_d8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  (val)<=(std::numeric_limits<N>::max()) in operator.cc
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_vptr_d8&range=426008:426025

Minimized Testcase (0.38 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97v-ucwzvLo9TQuQC4vPQOlVs4PDL8BLKTl5zTyd6WG186J1_pmxBjG5Xth25uio4qFezW8kSzoVszOjnxBY5kV3DBgUy3N2E6QLT5k977pAi1BPx4nSb2yOWEfqrHMNO31ixC3LGTQzOAyaysmTbfGJh5B9A?testcase_id=5426162538119168
function __f_1(n) {
  test_prefix = 'prefix ';
  test_suffix = ' suffix';
  var __v_1 = 'test_prefix + (function f(';
  for (var __v_2 = 0; __v_2 < n ; __v_2++) {
    if (__v_2 != 0) __v_1 += ',';
    __v_1 += '__v_2' + __v_2;
  }
  __v_1 += ') { return __v_2' + (n - n % 2) / 2 + '; })(';
  
  __v_1 += ') + test_suffix';
  return eval(__v_1);
}
try {
 __f_1(65535);
 __f_1();
} catch(e) {; }


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.