// Looks like a fullcode vs ignition problem? I.e. from old validator. Though, this also repros with ignition_turbo_opt vs. x64,ignition_turbo_opt_eager.

A = {}
__v_0 = new Proxy(A, { get(property) {} });
function __f_4() {
  "use asm";
  function __f_5() {
    __v_0 = __v_0|0;
  }
  return { __f_5: __f_5 };
}
__f_4().__f_5();

// Output:
# Compared x64,ignition_turbo_opt with x64,ignition_turbo_opt_eager
#
# Flags of x64,ignition_turbo_opt:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --es-staging --random-seed 732681078 --ignition --turbo --always-opt
# Flags of x64,ignition_turbo_opt_eager:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --es-staging --random-seed 732681078 --ignition --turbo --always-opt --no-lazy --no-lazy-inner-functions
#
# Difference:
- ./repro.js:6: TypeError: Cannot convert object to primitive value
+ ./repro.js:7: TypeError: Cannot convert object to primitive value
#
# Source file:
none
#
### Start of configuration x64,ignition_turbo_opt:
./repro.js:6: TypeError: Cannot convert object to primitive value
  function __f_5() {
                ^



### End of configuration x64,ignition_turbo_opt
#
### Start of configuration x64,ignition_turbo_opt_eager:
./repro.js:7: TypeError: Cannot convert object to primitive value
    __v_0 = __v_0|0;
                 ^



### End of configuration x64,ignition_turbo_opt_eager

 Issue 709740  has been merged into this issue.

 Issue 715231  has been merged into this issue.

ClusterFuzz has detected this issue as fixed in range 45316:45317.

Detailed report: https://clusterfuzz.com/testcase?key=5033011503693824

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition:x64,ignition_turbo_opt
  sources: none
  
Sanitizer: address (ASAN)

Regressed: V8: 43536:43537
Fixed: V8: 45316:45317

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5033011503693824


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5191473164451840 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Nope, pretty sure this is still a thing.

We have made a bunch of changes on ClusterFuzz side, so resetting ClusterFuzz-Wrong label.