Reduced repro ...

function fun() {};
fun.prototype = 42;
new fun();
function f() {
  print(fun.prototype);
}
f();
f();
%OptimizeFunctionOnNextCall(f);
f();

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/37b9d653c2b1f954b6b9471bf401aa0e78aa24f9

commit 37b9d653c2b1f954b6b9471bf401aa0e78aa24f9
Author: Michael Starzinger <mstarzinger@chromium.org>
Date: Wed Mar 22 10:12:23 2017

[turbofan] Fix lowering of Function.prototype accesses.

This fixes a corner case where the "instance prototype" diverges from
the "non-instance prototype" that we store on the initial map of a
constructor function.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-703610
BUG= chromium:703610 

Change-Id: I30a19ae621e10b512215ffb191ce00d030941440
Reviewed-on: https://chromium-review.googlesource.com/458396
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44008}
[modify] https://crrev.com/37b9d653c2b1f954b6b9471bf401aa0e78aa24f9/src/compiler/js-native-context-specialization.cc
[add] https://crrev.com/37b9d653c2b1f954b6b9471bf401aa0e78aa24f9/test/mjsunit/regress/regress-crbug-703610.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/37b9d653c2b1f954b6b9471bf401aa0e78aa24f9

commit 37b9d653c2b1f954b6b9471bf401aa0e78aa24f9
Author: Michael Starzinger <mstarzinger@chromium.org>
Date: Wed Mar 22 10:12:23 2017

[turbofan] Fix lowering of Function.prototype accesses.

This fixes a corner case where the "instance prototype" diverges from
the "non-instance prototype" that we store on the initial map of a
constructor function.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-703610
BUG= chromium:703610 

Change-Id: I30a19ae621e10b512215ffb191ce00d030941440
Reviewed-on: https://chromium-review.googlesource.com/458396
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44008}
[modify] https://crrev.com/37b9d653c2b1f954b6b9471bf401aa0e78aa24f9/src/compiler/js-native-context-specialization.cc
[add] https://crrev.com/37b9d653c2b1f954b6b9471bf401aa0e78aa24f9/test/mjsunit/regress/regress-crbug-703610.js

ClusterFuzz has detected this issue as fixed in range 44007:44008.

Detailed report: https://clusterfuzz.com/testcase?key=5756434286641152

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition:x64,ignition_turbo_opt
  sources: 2c6
  
Sanitizer: address (ASAN)

Fixed: V8: 44007:44008

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv94gwoyQjC3Gb3wZlyGQ5Kr9d0bLLjZ-AFhyZ-EwBtrj4H_DS4jX3aRzRJDK8jAk17pafFPyPB-gRJ4RiLXACaT0hpicFXfEo8eW_4vDMAdO5oP6x15F9QyoJHkjry1-MXHamj4Nsn3kr7GSd0-XGWD3VRcCRVF8013MEQCsDZFh6MTpaq51W4pKji8iBSYg_gx71wLX_kvn9djWdyfxPAZ-r_VjcNGIe-1kwRO-nlnDWRvhisDOLfKo-3khuYV_fkjynsk0wYUGpNpa_cV9wpmHy9cANV6mR6UaG9vOgld9qtt708CRG5l7On_N789rH_hSz5gAyTRcFQusE_a3waz_9Uge6JyBv7AITVtHRepVTbe5jCiJwr_e4M0WwwkEg2NpYLpAnbmOzaPPCPrHe5hyEyW6lQ?testcase_id=5756434286641152


Additional requirements: Requires Gestures

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.