@Marja, I assume this is WAI? Repro:

try {
  eval("function Crash() { assertUnreachable(); continue;if (Crash) {  } }");
} catch (e) {
}
print(Object.getOwnPropertyNames(this).length)

-> length differs, has a "Crash" property in one version

ClusterFuzz has detected this issue as fixed in range 46985:46986.

Detailed report: https://clusterfuzz.com/testcase?key=6441460252803072

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition_turbo_opt:x64,ignition_turbo_opt_eager
  sources: 89e
  
Sanitizer: address (ASAN)

Regressed: V8: 44902:44903
Fixed: V8: 46985:46986

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6441460252803072


See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6441460252803072 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Hmm so with lazy we don't notice the stray "continue", but just parse the func. And that will create the Crash function. So sounds WAI to me too.