V8 Map Migration Type Confusion

v8 Map migration doesn't respect element kind, leading to type confusion The following sample, found by Fuzzilli and manually simplified, crashes d8 built from HEAD in both debug and release configuration: function main const v2 = foo:1.1; Object.sealv2; Object.preventExtensionsv2; Object.freezev...