Issue 676955  has been merged into this issue.

Fix on its way here: https://codereview.chromium.org/2609973002

ClusterFuzz has detected this issue as fixed in range 42063:42064.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5786311064813568

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  v8::internal::Map::instance_type
  IsHeapNumber
  IsHeapNumber
  
Sanitizer: address (ASAN)

Regressed: V8: r41367:41368
Fixed: V8: r42063:42064

Minimized Testcase (0.12 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94wVDU3219p8tnB5OLG2HwewepZjKtIt8HJO7mLHxe-izuWtdzbjoUEP3NUMcgId6hsnHRlCnT8o3wufK3fK3SYW4Qk9Tlg_GJnkstmVcgZj88gJpA3zhpkTYoq--encvNz2NcAD943lQYM_FKSsyfUV6IuhmYv2ETYCpWEtRAOyHZ2rkGpxV-6VEYTTZGDo56yJl-CtxTPDynz9NMWIOcR2mtDHWBLDkZsTrwGE1dCHvWyGY1BMe4R-wkczfW5QYrsYfqjdjPpKhIuFLgtdL1d77teRFkHkfrTmruy6CFYUs5bnerIl1alH7X95sa48T8R_HCnS4_Yhl0Hn2H0lxXGC4eTw19A1GzSrw1XOxSCTSp8_yk?testcase_id=5786311064813568
__v_0 = Array(100000);
(function() {
  var __v_1 = [];
  for (var __v_2 = 0; __v_2 < 7; __v_2++) {
 __v_0.push();
  }
})();


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.