PTAL

ClusterFuzz has detected this issue as fixed in range 34586:34587.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6671660058411008

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x000000000000
Crash State:
  v8::TranslateAsmModule
  v8::InstantiateModuleFromAsm
  v8::internal::FunctionCallbackArguments::Call
  
Regressed: V8: r33250:33251
Fixed: V8: r34586:34587

Minimized Testcase (0.07 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95uTLY4Koy8mUzXPfDdEedZ8Sj6d5_RqrULihUNdxgGgw_iquKbMpK73XxPJiALyqYcAtk4Akq4DF7SW2JUSjL_2xp3PVmx0DgvAOFwPVquY4OxkrXjow07CeKyVOAafSBFu_-Ql76mxub4764z_3CKkW6fxA
var __v_2 = "";
    var module = _WASMEXP_.instantiateModuleFromAsm(__v_2);


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4915665638522880

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_chrome_v8_d8
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x000000000000
Crash State:
  v8::TranslateAsmModule
  v8::InstantiateModuleFromAsm
  v8::internal::FunctionCallbackArguments::Call
  
Regressed: V8: r34577:34596

Minimized Testcase (0.09 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97CDeRnqyjtZxFFNW5go1vmgmb2rZGPHGZsq-J8vWYLK5sooxZVdyWc37qRokLDvIQ5aKtLwv2uOV1ROLCdenKArM38lUe00lTS94_2ixNGtYMmuXIE-HOY00qRfLW3y8ctLlpl3k2yypIF-rZo_eJd_kne0Q
var __v_6 = "";
(function () {
})();
    var module = Wasm.instantiateModuleFromAsm(__v_6);


Filer: nyerramilli

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Remove legacy label cr-blink-javascript.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4774703184478208

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  v8::TranslateAsmModule
  v8::InstantiateModuleFromAsm
  v8::internal::FunctionCallbackArguments::Call
  
Regressed: V8: r34586:34587

Minimized Testcase (0.17 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94URJmuq0FjgcFUZrAhcw2EsMBKxl3LW7W1wLgfZ54UPBEc1T3znpxRgtm2o_tsBKlZt-to9-1K0-NpZRS-wPXnqDXyj2NDjh8pf5dv2lApu3Z0sH-U0eaHOPgFqHuAeieWib_-rice5xMOOOgjVc7IK6BXOw
__v_4 = Object.defineProperty(new String, 'toString', { value() {; return ''; } });
    __v_4 = __v_4.replace();
    var module = Wasm.instantiateModuleFromAsm(__v_4);
( {
})();


Filer: hablich

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4670197528526848

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000008
Crash State:
  v8::internal::AsmTyper::VisitHeapAccess
  v8::internal::AsmTyper::VisitAssignment
  v8::internal::AsmTyper::VisitWithExpectation
  
Regressed: V8: r34586:34587

Minimized Testcase (0.54 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94Yn4YQ7hhb8rGwN3Ot2xO4TXRb_bY-JwC9JcToSO7A0k58mxUK26MFZqrWVLonRt_HARa3AxiNnhozsftIP5dcjvMGWsr7d8mu5EmFUU4XDsSYzUhupFI8m5fv_r3N_-UHsEKnr3Y27C1HKRqJfqjxG5GOsQ
function __f_90(stdlib, buffer) {
  "use asm";
  var __v_30 = new stdlib.Int32Array(buffer);
  function __f_69() {
    var __v_27 = 4;
    __v_30[__v_27 >> 2] = ((__v_30[0]|0) + 1) | 0;
  }
}
  var __v_19 = [ [], [], [Int16Array, 'Int16Array', '>> __v_5'], [][ '>> -57'], []];
  for (var __v_27 = 0; __v_27 < __v_19.length; __v_27++) {
    var __v_2 = __f_90.toString();
    __v_2 = __v_2.replace(/>> 2/g, __v_19[__v_27][2]);
    var module = Wasm.instantiateModuleFromAsm(__v_2);
  }
  function __f_69() {
    }
( {
})();
(function __f_66() {
})();


Filer: hablich

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

ClusterFuzz has detected this issue as fixed in range 35973:35974.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4774703184478208

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  v8::TranslateAsmModule
  v8::InstantiateModuleFromAsm
  v8::internal::FunctionCallbackArguments::Call
  
Regressed: V8: r34586:34587
Fixed: V8: r35973:35974

Minimized Testcase (0.17 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94URJmuq0FjgcFUZrAhcw2EsMBKxl3LW7W1wLgfZ54UPBEc1T3znpxRgtm2o_tsBKlZt-to9-1K0-NpZRS-wPXnqDXyj2NDjh8pf5dv2lApu3Z0sH-U0eaHOPgFqHuAeieWib_-rice5xMOOOgjVc7IK6BXOw
__v_4 = Object.defineProperty(new String, 'toString', { value() {; return ''; } });
    __v_4 = __v_4.replace();
    var module = Wasm.instantiateModuleFromAsm(__v_4);
( {
})();


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 35967:36000.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4915665638522880

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_chrome_v8_d8
Platform Id: linux

Crash Type: UNKNOWN
Crash Address: 0x000000000000
Crash State:
  v8::TranslateAsmModule
  v8::InstantiateModuleFromAsm
  v8::internal::FunctionCallbackArguments::Call
  
Regressed: V8: r34577:34596
Fixed: V8: r35967:36000

Minimized Testcase (0.09 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97CDeRnqyjtZxFFNW5go1vmgmb2rZGPHGZsq-J8vWYLK5sooxZVdyWc37qRokLDvIQ5aKtLwv2uOV1ROLCdenKArM38lUe00lTS94_2ixNGtYMmuXIE-HOY00qRfLW3y8ctLlpl3k2yypIF-rZo_eJd_kne0Q
var __v_6 = "";
(function () {
})();
    var module = Wasm.instantiateModuleFromAsm(__v_6);


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot