Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5589754113687552

Fuzzer: foozzie_js_mutation
Job Type: foozzie_ignition_staging
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,fullcode:x64,ignition_staging
  sources: 9c0
  
Sanitizer: address (ASAN)

Regressed: V8: 42370:42371

Minimized Testcase (0.62 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94qfvVJqSJoaFn8PHAjGjyUUmUpTiIt7c7tRBu2DoRlklkKWoU7tbQWXkhaNo3FtVFFafucqrXYl4LW23G60AfQH9RJhJwWjMAjubcTtsWvUy5loLVpb_lMLDfZiw9E526A-g_6uFHnUn8dMVqks26gEYlRP-R5Li1Hu2-4AqINT7eu-URrDeBnj5ZbtKfJn5YP6Un1sRqbYjzuvnbUzSjsCGNjzYABU4qJFx95BJXfMP4yh6SnVC_-lxwOrKVtiS5DPJWRIX3ivNcu_vdko5L28qPk9oJp8npgKRj6oDM7P0uJR-wLXZD0ECQNu4nyBpq6AuZlSIT6tUKWZZYDDi5evOwMH8b3j9a4CNQ71Cm9EAvZM5k?testcase_id=5589754113687552
__PrettyPrint = function __PrettyPrint(value, depth=__max_depth) {
  switch (typeof value) {
    case "object":
      switch (objectClass) {
      case "Number":
      }
  }
}
assertEquals = function assertEquals(expected, found, name_opt) { print(found); };
var __v_0 = 1073741823;
var __v_1 = function() {};
print("v8-foozzie source: /v8/test/mjsunit/compiler/inline-literals.js");
function __f_1() {
  return __v_1;
}
function __f_4(a, b, c) {
  return a + __f_1()();
}
function __f_5(a, b, c, __v_3) {
  var __v_2 = __f_4(a, b, c);
  assertEquals(__v_0, __v_2, "__f_5");
}
__f_5();
%OptimizeFunctionOnNextCall(__f_5);
__f_5( "c");


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.