Something going wrong when materializing contexts during a deopt. I'll need to investigate.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/e6590a37ba882f23efb4dad53fbe51d3bccd305c

commit e6590a37ba882f23efb4dad53fbe51d3bccd305c
Author: Michael Starzinger <mstarzinger@chromium.org>
Date: Tue Apr 18 14:44:01 2017

[turbofan] Fix translation containing arguments elements.

This fixes the de-duplication logic used when writing the deoptimizer
translation of a frame-state containing {kArgumentsElementsState}. The
object counts as a captured object and participates in the numbering of
duplicated objects.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-711166
BUG= chromium:711166 

Change-Id: I4a3b892017ab8217197e5f94c1a0975d0cd6979f
Reviewed-on: https://chromium-review.googlesource.com/476631
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44692}
[modify] https://crrev.com/e6590a37ba882f23efb4dad53fbe51d3bccd305c/src/compiler/instruction-selector.cc
[add] https://crrev.com/e6590a37ba882f23efb4dad53fbe51d3bccd305c/test/mjsunit/regress/regress-crbug-711166.js

ClusterFuzz has detected this issue as fixed in range 44691:44692.

Detailed report: https://clusterfuzz.com/testcase?key=4772569636143104

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  context->IsContext() in contexts-inl.h
  
Sanitizer: address (ASAN)

Regressed: V8: 43683:43684
Fixed: V8: 44691:44692

Reproducer Testcase: https://clusterfuzz.com/download/AMIfv97Tv6X7pnQdvJzwTbWoC6X-mp1wCEf4_suNozlZRsUPemID2r7hNGaaoN0ULk_m0WqR_5AgzjxoXBMkGERnJpKS83ixVbbMV4Z6LiUO56VNsaGn46YTnyPUq7Th_oGG3N_MKnJDTfEzbx6WPd2fT8chjRR8ukLvjPaGEwJ1iazif0lL_MSwKKUCvs7t5Sh55NB3LyfMUJZxZw3zRtIvbX2Mpfb2lWYhJYIuVf8ZqSTznyNzjmQuLoN6BsKj2NygGIJckLeQMq0lFewfGVeYgulPKUvUo3XKWivfK8En4--RbcVWnS-R2AkdFPrQEhneoGQUKXuegJl9agbeleTmWTDyhucZCiyv80uMGzyXdNnNrsp0peU?testcase_id=4772569636143104


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.