ClusterFuzz has detected this issue as fixed in range 446650:446721.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5842524481781760

Fuzzer: mbarbella_js_mutation
Job Type: linux_ubsan_vptr_d8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  Encountered unaccounted use by #96 (Call) in escape-analysis.cc
  
Sanitizer: undefined (UBSAN)

Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_vptr_d8&range=446318:446618
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_ubsan_vptr_d8&range=446650:446721

Minimized Testcase (0.32 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97Lb1PjC6iH1CnnqBKw_GWi0H3NPmnOd5JWudSmCxol9FiuhOU3xxXc97NgdXI3WusRZvJpEaPaoD9drTnI_7mHo15hXA-mpGLw4F2IQxerils_EiZtpCXxwSB0iyFRENpBQkdvNsX0x_bKzehSk81tcK3HuyXlRaQLYA3Q7mK_SXB5XKtKwkEh60eqIpN-VBXBSyI-tWZaZMO1vnzSq2Gn6mrOpo4h1jch6yBCybVLmXbWPJ0gULKmYul8N-K8FmzOv3Y2vQ26yxw0fmm0E8j1BFziizAAXEkvGt9N1_ezx-7cNVyy1TAEhiVgu-81SBKX3qZvSWOqrdqDWbOsLnlQXqpORfhC3cfpkfzr7M1BIV7QtUY?testcase_id=5842524481781760
assertTrue = function assertTrue() {; };
  for (var __v_0 = 4; __v_0 < 1073741824; __v_0++) {
    __f_36();
  }
function __f_36() {
  var __v_7 = false;
  try {
    new ReferenceError({
      toString: function () {
        FAIL;
      }
    });
  } catch (e) {
    assertTrue(e.stack.indexOf('at new ReferenceError') != -1);
  }
}


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.