Again, the revert seems to trigger some crashers.

ClusterFuzz has detected this issue as fixed in range 42547:42548.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4728001540653056

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_mipsel_dbg
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x0000001c
Crash State:
  v8::internal::compiler::CanInlinePropertyAccess
  v8::internal::compiler::AccessInfoFactory::ComputePropertyAccessInfo
  v8::internal::compiler::JSNativeContextSpecialization::ReduceJSStoreDataProperty
  
Sanitizer: address (ASAN)

Regressed: V8: 42494:42495
Fixed: V8: 42547:42548

Minimized Testcase (0.22 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv96j4uRNd8Fn6JXWds4OYM6OJBn13tx5HzCVMTxtjP9Cf3vkIev_ca0tvXczf0ThEUw6IJLVOuZJnHAHhRdUELX_AKtMW48US1aL6qJofRBeg6j7mwyVvn6F6MvjlVXxDFBrH6GXrJdAhMb9JKW1hLV-ztpR-UwzAtbiA-kKP5F3GdghRZpYi40-f_hyTKRjf2TEpwu5JQ05uUzV0AYXj8LqRSRW8qkNl9aV8o9RCdjo7j3QKSGvTsvttVT8lvpLCmViHJu_c_VfBGPA7m_i4iRYXAcVdbnIQcjihlNdsvm-i8l6EhTcXDNdthzvIxag1pz35LcUZZ1xBs754LEwfW_jUro2iuVz03_CxSFh3wmPtzTAKKs?testcase_id=4728001540653056
function __f_4() {
  class __v_2 { static foo() { return one + 6; } }
}
for (var __v_9 = 0; __v_9 < 5; ++__v_9) __f_4();
%OptimizeFunctionOnNextCall(__f_4);
gc();
__f_4();
  try {
  } catch (__v_2) {
    ( {
    })();
  }


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.