Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5679687344062464

Fuzzer: inferno_twister_custom_bundle
Job Type: linux_asan_chrome_media
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !field_type->NowStable() || field_type->NowContains(value) || (!FLAG_use_allocat
  v8::internal::JSObject::JSObjectVerify
  v8::internal::Object::ObjectVerify
  v8::internal::PagedSpace::Verify
  
Sanitizer: address (ASAN)

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96gT1vU3ZBKSF1vnGXzDDe2oE-kkT9VJ5NZfGiZKbQs2w3BFd0E7yRJLkaCP35AlKaeKf3P8Wmh92mhFYtT1rnw8SPu3AXa7xd-0asIrlBxfaTmFSxVQRY3GmQdFYTmM-U--hG7WLLJhFtKoTZmVhvosgUYFJUrpdPs9PzExCSsRJhU288?testcase_id=5679687344062464


Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.