Regression range points to 4635572471b28a38f04307fabc69d5e1802d1049. The following is the extracted (and slightly reduced) test case:

  var src = "(?:";
  for (var i = 0; i < 100000; i += 100) {
    src += String.fromCharCode(i) + "|";
  }
  src += "aa)";
  var collapsible = new RegExp(src, "i");
  collapsible.test("zzzzzzz");

Shorter repro: 

out/debug/d8 <<< '/\uDB88|\uDBEC|aa/.exec()'

Just a wrong DCHECK. It should be: 

DCHECK_IMPLIES(unicode, !unibrow::Utf16::IsLeadSurrogate(atom->data().at(0)));

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/876e23c54d5fa2cb2a399632175d94e597da5330

commit 876e23c54d5fa2cb2a399632175d94e597da5330
Author: jgruber <jgruber@chromium.org>
Date: Thu Apr 13 10:33:08 2017

[regexp] Fix incorrect DCHECK in FixSingleCharacterDisjunctions

The condition only applies in unicode mode, where any lone surrogates
are desugared into a character class (and will not be considered in this
optimization). Non-unicode mode treats lone surrogates exactly like
any other codepoint.

BUG= chromium:711092 

Review-Url: https://codereview.chromium.org/2808403006
Cr-Commit-Position: refs/heads/master@{#44638}

[modify] https://crrev.com/876e23c54d5fa2cb2a399632175d94e597da5330/src/regexp/jsregexp.cc
[modify] https://crrev.com/876e23c54d5fa2cb2a399632175d94e597da5330/test/mjsunit/regexp.js

ClusterFuzz has detected this issue as fixed in range 44637:44638.

Detailed report: https://clusterfuzz.com/testcase?key=5746392267227136

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !unibrow::Utf16::IsLeadSurrogate(atom->data().at(0)) in jsregexp.cc
  
Sanitizer: address (ASAN)

Regressed: V8: 44598:44599
Fixed: V8: 44637:44638

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv955S_8-PG-PFDLTFGFQNl_GzUsIsA1kOlF3iZVTwoOpiZhBqM3M3suL66c6D01zaX8l7JpHNrh7R5E0lHQjZVE2g100fC0OeerhxEJogHD8OfkV_y4pHc8VeFTw2IPdVN5fc_oBCNfae1UxK_OIXhlM0yNrltYQEq6ONMadt9ovANqVAdDXZCb_judN48QCao5AWttYLoz0RfDlTVk5jrjtaPtY6yhfiPZFklfKQ4HPUJGsjBeUI6VFK00tWT_UfAB5T3gQHl0dn632r7qf7MHXzsLT6SZ4XkJpVlv_jMz_ZYxzzXNAqzBcKNLdVzueK-NZbRgJyLuxO843rh9hnfzE1UsfVQF3pVfd7Jsu01lISKzsJho?testcase_id=5746392267227136


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.