Fix for Clusterfuzz issue 343928.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 410292d336aa97362a462e308c6fd6100dd04e97..7c704bce31f8992002a4a3050ea174bd813e19b0 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -5443,6 +5443,12 @@ bool JSObject::ReferencesObject(Object* obj) {
 
     // Check the context extension (if any) if it can have references.
     if (context->has_extension() && !context->IsCatchContext()) {
+      // With harmony scoping, a JSFunction may have a global context.
+      // TODO(mvstanton): walk into the ScopeInfo.
+      if (FLAG_harmony_scoping && context->IsGlobalContext()) {
+        return false;
+      }
+
       return JSObject::cast(context->extension())->ReferencesObject(obj);
     }
   }