ClusterFuzz has detected this issue as fixed in range 42445:42446.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6271138192949248

Fuzzer: foozzie_js_mutation
Job Type: foozzie_ignition_staging
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,fullcode:x64,ignition_staging
  sources: b6d
  
Sanitizer: address (ASAN)

Regressed: V8: r42401:42402
Fixed: V8: r42445:42446

Minimized Testcase (0.71 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv940pLiFjb-37Sb5lMkFuRCaYWoWsETs06h7M8Et9_gl6d_NybvA5OlLpR7OlqWtHUpsBiNnl4d-zONZecFwcD6bi1f8A6i5Ip4vv-v8GBWjU3EnoqV4bTZ95BrAEyyKOXweiKMl5uxOS9HheAjm-VaUOHmaVgmGP2pfEQm9tclmPGboE0RDk6CYzxnyJGs9QR52u1cW3cfXog-1YVXTbTzkzQo9S4--OQiQmX9waB1cYnZnOlzpdsL8yoxFcaqhQUOiLiCsja67L7rqbatTcG9B30VcPmrt8ruSVXeneL85XBlmhSGmxC7a909oaE7ZOFwvWn53K-DTrwh_rTfTyGoKJFQ9w7eh58GJUML124eh2kYWmDU?testcase_id=6271138192949248
  switch (typeof value) {
    case "string":
  }
var __v_13 = 65535;
var __v_14 = 4294967295;
__v_8 = 0;
print("v8-foozzie source: /v8/test/mjsunit/regress/wasm/regression-647649.js");
function __f_10(v, rand) {
  var __v_13 = Object.getOwnPropertyNames(v);
  return __v_13[rand % __v_13.length];
}
function __f_9(stdlib, foreign, buffer) {
  "use asm";
  var __v_12 = new stdlib.Float64Array(buffer);
  function __f_8() {
  }
  return {__f_8: __f_8};
}
Array.prototype.__proto__ = {3: __v_13};
Array.prototype.__proto__.__proto__ = {7: __v_8};
__v_9 = [11, 14, , , -1073741824, -3, , , , -1073741825]
__v_12 = __v_9.splice(4, 1)
__v_9.__defineGetter__(__f_10(__v_9, 1689439720), function() {; return __f_9(); });
 __v_9[8]


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.