Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/e71b802279ccc474820068af7f63218e71a5a48a ([deoptimizer] Staged materialization of objects.).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

ClusterFuzz has detected this issue as fixed in range 49833:49834.

Detailed report: https://clusterfuzz.com/testcase?key=5097505070252032

Fuzzer: decoder_langfuzz
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  arg_elements == isolate->heap()->empty_fixed_array() in objects-debug.cc
  v8::internal::SloppyArgumentsElements::SloppyArgumentsElementsVerify
  v8::internal::JSArgumentsObject::JSArgumentsObjectVerify
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=49820:49821
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=49833:49834

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5097505070252032

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5097505070252032 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

I'm afraid this was also found by an internal fuzzer.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot