Local bisect confirms 54271c21e2860273abd6018c398b04f672ef2615.
Alexey, can you take a look please?

+Camillo to check whether this is related to  crbug.com/738763  (it's the same check failure).

Just from the error message I'd be surprised if the mentioned CL is the root cause.
I think the CL just changed the gc timing a bit to make this repro work.

Probably this is an IC issue, unrelated to either CL mentioned.

ClusterFuzz has detected this issue as fixed in range 46621:46622.

Detailed report: https://clusterfuzz.com/testcase?key=6598446651015168

Fuzzer: inferno_js_fuzzer
Job Type: linux_asan_d8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !field_type->NowStable() || field_type->NowContains(value) || (!FLAG_use_allocat
  
Sanitizer: address (ASAN)

Regressed: V8: 44701:44702
Fixed: V8: 46621:46622

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6598446651015168


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.