As discussed, moving to machenbach@ for further triage.

JSON.parse throws different error messages. I couldn't reduce the test case much. Only the call to __f_6(50000) can be reduced to __f_6(5000) and it still repros.

Yang any ideas who could own this?

ClusterFuzz has detected this issue as fixed in range 43654:43655.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5489383009681408

Fuzzer: foozzie_js_mutation
Job Type: foozzie_ignition_staging
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,fullcode:x64,ignition_staging
  sources: d02
  
Sanitizer: address (ASAN)

Regressed: V8: 42370:42371
Fixed: V8: 43654:43655

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97Z33G-mN1Dyn0BrybF6gyC4nZKWcQTQfLA7Fy3goMXieahK3kSNKnACDSMslQ0-AqZB4w0OQ5wF_czk7jCywCctH6TrDnXlBDy0kiPGL9IMzVKQoj7bDy-1kDZH0iEXcUSGSljUInH-8FsYZrFB_vobg_aYbMRnrWpsM9SRqo85jH79pdRcL6XF-SL1f2FCoXJwbbvz9nGhjPwki5liNxnJjCNzSGmgFiYfyDzJoOWPZdMRSMZWA4XYB6fFDYJKX_C4n3NgNbTubjvIAnUwWdaJwp6-vv-Ma7xyf-fR0swaouQ8htHHKR48pVAURx9xUfNgyU65Zts4Il_9f6AVvAqr1PHqdCyxZZtCp5C2rRgyQMtMMI?testcase_id=5489383009681408


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

The flag negation implication CL seems to have an impact on those old issues.
https://chromium.googlesource.com/v8/v8/+/f774d8c56f00de92614886fc4cb541411eff7aa1

The real issue is still there, this might suggest that it was a crankshaft issue.

ClusterFuzz testcase 5489383009681408 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

We have made a bunch of changes on ClusterFuzz side, so resetting ClusterFuzz-Wrong label.