Regression range points to 523959df0a14f6548ed4d488eb006a0123b7fe84.

The problem is that the compilation above might fail and that's why is_compiled is false. This doesn't affect the behavior though (we'll get some dummy number of properties which is not useful anyway).

I'll try to restructure the code a bit to be able to keep the DCHECK in...

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/930174c25c3ad349cc55070b9e1a32d0d83a5a6c

commit 930174c25c3ad349cc55070b9e1a32d0d83a5a6c
Author: Marja Hölttä <marja@chromium.org>
Date: Mon Apr 10 11:03:30 2017

[parser] Skipping inner funcs: Fix untrue DCHECK.

The DCHECK added by https://chromium-review.googlesource.com/461827 was not true
in case we failed to compile the function.

BUG= chromium:708598 

Change-Id: I6a542c3ac6281c0549396b4ff0af34ea44450006
Reviewed-on: https://chromium-review.googlesource.com/472826
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44513}
[modify] https://crrev.com/930174c25c3ad349cc55070b9e1a32d0d83a5a6c/src/objects.cc
[modify] https://crrev.com/930174c25c3ad349cc55070b9e1a32d0d83a5a6c/src/objects.h
[add] https://crrev.com/930174c25c3ad349cc55070b9e1a32d0d83a5a6c/test/mjsunit/regress/regress-708598.js

ClusterFuzz has detected this issue as fixed in range 44512:44513.

Detailed report: https://clusterfuzz.com/testcase?key=5901584266690560

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_v8_mipsel_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  shared()->is_compiled() in objects.cc
  
Sanitizer: address (ASAN)

Regressed: V8: 44409:44410
Fixed: V8: 44512:44513

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv95XLlnsseqmU96rIuTYf9YHMfoJvePR5_LPm_botkx8YKEVjgNqvDYrzYqztC_oeOm0mbg1Ko5kV6CxngfIZo5hT-1aldVa2OpNOFvFarv0oaKckkjyyZGecb7-e5aXpHSm1cf7PoO_d8bUd-ENEX-1c4TCKGs1xmGuqtPcWSNn9PBtu8nW9xHig0KALeJBhgTtXhQ3rVa9_XuW9vkwtNxY2D2IYDKKsKq2OdzFQl2lEyJRG_0GrbmEGtRcU4-L8MP7G6TBOdCikQj3ok_J_w8q_RZNKZQttsiOu0cKVaDGaHKflnDk_h9tLtvOyg5-Zi9pELUsZjoEpQFxH0375hfEWUURBkBMVzcjll7S9sbTgnqsrYU997YSVjt5-8EmiVqlJ5YPbc99IAHCvjOHS3_sPvEQMQ?testcase_id=5901584266690560


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.