Bisects to bb90a2e85d2ab22787b4f8ad11f54fe6e797c3c1.

 Issue 722974  has been merged into this issue.

CL is reverted. Will reland once the issue is fixed.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/789b60458bb9f2b0503e63352db244e0e196a579

commit 789b60458bb9f2b0503e63352db244e0e196a579
Author: Georg Neis <neis@chromium.org>
Date: Wed May 17 12:20:38 2017

Reland "[compiler] Delay allocation of heap numbers for deoptimization literals."

Original CL description:
  [compiler] Delay allocation of heap numbers for deoptimization literals.

  ... until after the main bulk of code generation, which will soon run on a
  different thread.

Bug:  v8:6048 ,  chromium:722978 
Change-Id: I690c0b009211a2bac60cf06f577720a914c21000
Reviewed-on: https://chromium-review.googlesource.com/507207
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45371}
[modify] https://crrev.com/789b60458bb9f2b0503e63352db244e0e196a579/src/compiler/code-generator.cc
[modify] https://crrev.com/789b60458bb9f2b0503e63352db244e0e196a579/src/compiler/code-generator.h
[add] https://crrev.com/789b60458bb9f2b0503e63352db244e0e196a579/test/mjsunit/regress/regress-722978.js

ClusterFuzz has detected this issue as fixed in range 45365:45366.

Detailed report: https://clusterfuzz.com/testcase?key=6570424766038016

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition:x64,ignition_turbo_opt
  sources: adb
  
Sanitizer: address (ASAN)

Regressed: V8: 45339:45340
Fixed: V8: 45365:45366

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6570424766038016


Additional requirements: Requires Gestures

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.