CF points to 806b350482b7c6423a5bac561a7fa8f55fcc845c. PTAL.

Looking. Minimized test:

function make_cons_string(s) {
  return s + "aaaaaaaaaaaaaa";
}

// Only the optimized version can return a real cons string.
make_cons_string("");
%OptimizeFunctionOnNextCall(make_cons_string);
var str = make_cons_string("");

new RegExp(str);  // Triggers IsFlat(str) check.

The issue was an incorrect use of String::Flatten here: https://cs.chromium.org/chromium/src/v8/src/objects.cc?q=EscapeRegE+package:%5Echromium$&l=16112.

Flatten does not modify the argument but returns a flattened result string.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/5002a4a96144cd1c1d2031314e39c7dee68fc450

commit 5002a4a96144cd1c1d2031314e39c7dee68fc450
Author: jgruber <jgruber@chromium.org>
Date: Thu Mar 09 12:25:19 2017

[regexp] Properly flatten string during initialization

This fixes an incorrect usage of String::Flatten in EscapeRegExpSource.

It also adds %ConstructConsString (to easily and reliably construct cons
strings in tests) and Factory::NewConsString (to enable guaranteed cons
string construction without preemptive flattening attempts).

BUG= chromium:698790 

Review-Url: https://codereview.chromium.org/2736383003
Cr-Commit-Position: refs/heads/master@{#43686}

[modify] https://crrev.com/5002a4a96144cd1c1d2031314e39c7dee68fc450/src/factory.cc
[modify] https://crrev.com/5002a4a96144cd1c1d2031314e39c7dee68fc450/src/factory.h
[modify] https://crrev.com/5002a4a96144cd1c1d2031314e39c7dee68fc450/src/objects.cc
[modify] https://crrev.com/5002a4a96144cd1c1d2031314e39c7dee68fc450/src/regexp/jsregexp.cc
[modify] https://crrev.com/5002a4a96144cd1c1d2031314e39c7dee68fc450/src/runtime/runtime-test.cc
[modify] https://crrev.com/5002a4a96144cd1c1d2031314e39c7dee68fc450/src/runtime/runtime.h
[add] https://crrev.com/5002a4a96144cd1c1d2031314e39c7dee68fc450/test/mjsunit/regress/regress-698790.js

ClusterFuzz has detected this issue as fixed in range 43685:43686.

Detailed report: https://clusterfuzz.com/testcase?key=5945623443668992

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_mipsel_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  IsFlat() in objects-inl.h
  
Sanitizer: address (ASAN)

Regressed: V8: 40884:40885
Fixed: V8: 43685:43686

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv96c1FUQqQS0lVByxdc9JM67D5OMIrw6WDcbo6xWOwcfTOzNbk6JTP7h7wP2Fmo4s76Enh-AbhNsVX52v-NNXIXVy57F0pJa6nv9cMTlt7TCUroVtqNK8nuVxzdXFOBI4hS3qbLObLLY7-7vXJFXPIjZy-FKtYFtf_EXEhsPVsnYDvQytMLARzFq_vFnivZHY3TDQ_A89e2Iq_KQvLPzMQkSVLXIPS4DnxUjakJsShwkv6QwNzggCLGowSEKPvXoi1UJhn4pQgZbGIZ_PQfglJYmiHD-3ot_TLgKXuOQERpgaNWa4jhlYCys0bOfpnNqoaYxV0I5Xb32W5FJFiIRs4WgzOlzEuLxWimhR0Mo85qElfWVb-k?testcase_id=5945623443668992


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.