ClusterFuzz has detected this issue as fixed in range 441109:441112.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4811742451597312

Fuzzer: mbarbella_js_mutation
Job Type: linux_ubsan_vptr_d8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  Phi of kRepFloat64 ((PlainNumber | NaN)) cannot be changed to kRepWord32 in repr
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_vptr_d8&range=440451:440487
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_vptr_d8&range=441109:441112

Minimized Testcase (0.22 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96eRDqJzfwO8xH3Ps84F13SIaX2K3YENDeA5uQx17vmEOdDRTi0zbYYcN9gFxPcuS2P2T3Zhz0FvNFbzyXyFrlFVV2fZN582-2co-RKnzXJ2Fmas4NNjB4Pwg5WW20SX8XvS5uOXaw8IYnfxehOgth-NFvo0HI8j9uB9XrQJV86vqodemU5Oz4biwUb14OrcI00_YvOvePQnlNQVdD8XzhbGr_oIb-A2bwDM8z0oENIEV-BdpHfkbCjAT_D16R8fFqCq3wgaRdm66En2Gz7e7uRSPCm-cBjlr1LObxyDgOCd1DiQo_0LOm2qLPLBnqYXBKNn8Xg6-QRUe8zl5QpYd293HqSC7QUG6Rt9MfJ6LAIJMUceOg?testcase_id=4811742451597312
try {
( {
})();
} catch(e) {; }
function __f_2() {
  var __v_3 = 0;
  for (var __v_2 = 0; __v_2 < 100000; __v_2++) {
    __v_3 += __v_2;
  }
  __v_3 = __v_2;
  return function() { return __v_3; }
}
 __f_2()();
 __f_2()();


Additional requirements: Requires Gestures

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 4811742451597312 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.