PTAL

ClusterFuzz has detected this issue as fixed in range 34586:34587.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6548314100596736

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  kAstStmt != var_type in src/wasm/asm-wasm-builder.cc
  
Regressed: V8: r33250:33251
Fixed: V8: r34586:34587

Minimized Testcase (0.24 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv973ytndykcA6AuctobN9pI52zYCwFUUfxkrh4BaBk92kqIrWip0sWXHPmdq1tCccp6YUOkq7kHHFxOOQvPobbLdheVafzdeYVd0fLO3QwggTO199W-buHAdgTGyc31uw5dePmXzMKp9jK4afEwsdUOpm8GFvg
function __f_77() {
  "use asm";
  function __f_73() {
    __v_44 = __v_46;
    var __v_44 = 0x80000000;
    var __v_46 = 0x7fffffff;
  }
  return {__f_73:__f_73};
}
 _WASMEXP_.instantiateModuleFromAsm( __f_77.toString());
function __f_16() {
  }


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5755775066046464

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_mipsel_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  kAstStmt != var_type in src/wasm/asm-wasm-builder.cc
  
Regressed: V8: r34586:34587

Minimized Testcase (0.22 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv942ByoV0ZW4lT7N8qfSE6JamVhXYl-nAAKHtp6skOIxIcr0TXq4ACqhNqNPNdFQ0mLetK1jzvQpSBmsZmcJTaEZ4Zj45xGkm9adj_IxbZdeTU5z8oJExYtS2P-ruguJ0CmKzYfb9lP6t2PGgzIOknvlojoW0Q
try {
} catch(e) {; }
function __f_57() {
  "use asm";
  function __f_72() {
    __v_61 = __v_19;
    var __v_61 = 0;
    var __v_19 = 0;
  }
  return {__f_72: __f_72};
}
 Wasm.instantiateModuleFromAsm( __f_57.toString());


Filer: hablich

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Remove legacy label cr-blink-javascript.

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5755775066046464

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_mipsel_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  kAstStmt != var_type in src/wasm/asm-wasm-builder.cc
  
Regressed: V8: r34586:34587

Minimized Testcase (0.22 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv942ByoV0ZW4lT7N8qfSE6JamVhXYl-nAAKHtp6skOIxIcr0TXq4ACqhNqNPNdFQ0mLetK1jzvQpSBmsZmcJTaEZ4Zj45xGkm9adj_IxbZdeTU5z8oJExYtS2P-ruguJ0CmKzYfb9lP6t2PGgzIOknvlojoW0Q
try {
} catch(e) {; }
function __f_57() {
  "use asm";
  function __f_72() {
    __v_61 = __v_19;
    var __v_61 = 0;
    var __v_19 = 0;
  }
  return {__f_72: __f_72};
}
 Wasm.instantiateModuleFromAsm( __f_57.toString());


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4736664026480640

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: RUNTIME_ASSERT
Crash Address: 
Crash State:
  kAstStmt != var_type in src/wasm/asm-wasm-builder.cc
  
Regressed: V8: r34586:34587

Minimized Testcase (0.30 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv957YUUCQZY3OZAMyFpu3B1yoGkwjYyiFCjx39XXYpd810qrFAXNTbsQi7QxpW2pe2am1_QPyMnaINQr25dZ01kjmcD25suxow1G1lY3jS6VWsLNuuez6UX-ekA-p_ZIfnecYuyKm4G18-a2TnxKkStg4y6n3g
function __f_53(expected, __f_68, __f_7) {
 Wasm.instantiateModuleFromAsm( __f_68.toString());
}
function __f_25() {
  "use asm";
  function __f_74() {
    __v_37 = __v_37;
    var __v_37 = 0;
  }
  return {__f_74: __f_74};
}
__f_53(18, __f_25);
( {
})();
var __v_106 =
    {
      get source() {
      }
    }


Filer: hablich

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4736664026480640

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: RUNTIME_ASSERT
Crash Address: 
Crash State:
  kAstStmt != var_type in src/wasm/asm-wasm-builder.cc
  
Regressed: V8: r34586:34587

Minimized Testcase (0.30 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv957YUUCQZY3OZAMyFpu3B1yoGkwjYyiFCjx39XXYpd810qrFAXNTbsQi7QxpW2pe2am1_QPyMnaINQr25dZ01kjmcD25suxow1G1lY3jS6VWsLNuuez6UX-ekA-p_ZIfnecYuyKm4G18-a2TnxKkStg4y6n3g
function __f_53(expected, __f_68, __f_7) {
 Wasm.instantiateModuleFromAsm( __f_68.toString());
}
function __f_25() {
  "use asm";
  function __f_74() {
    __v_37 = __v_37;
    var __v_37 = 0;
  }
  return {__f_74: __f_74};
}
__f_53(18, __f_25);
( {
})();
var __v_106 =
    {
      get source() {
      }
    }


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5639056217604096

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_arm64_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  kAstStmt != var_type in src/wasm/asm-wasm-builder.cc
  
Regressed: V8: r34586:34587

Minimized Testcase (0.22 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94L3kMHCust_mZGvD6M5eBgFcdc0trCEozeoHtsNErPSlVFtXSSfSo0ENT7gWu35F-IPioOn7v0pDOrHJ1M3ejHCkW1dzDHkLvsh1ODelAc2FrDB9NLcmUNbNyG9By8bA7riCkkMU3hc9tmoR-jQ7o8jIRVeQ
  function __f_3(){
    'use asm';
    function __f_5() {
      __v_10 = __v_3;
      var __v_10 = 0;
      var __v_3 = 0
    }
    return { __f_5: __f_5 };
  }
  var __v_11 = Wasm.instantiateModuleFromAsm(__f_3.toString());


Filer: hablich

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

ClusterFuzz has detected this issue as fixed in range 35597:35598.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5639056217604096

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_arm64_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  kAstStmt != var_type in src/wasm/asm-wasm-builder.cc
  
Regressed: V8: r34586:34587
Fixed: V8: r35597:35598

Minimized Testcase (0.22 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv94L3kMHCust_mZGvD6M5eBgFcdc0trCEozeoHtsNErPSlVFtXSSfSo0ENT7gWu35F-IPioOn7v0pDOrHJ1M3ejHCkW1dzDHkLvsh1ODelAc2FrDB9NLcmUNbNyG9By8bA7riCkkMU3hc9tmoR-jQ7o8jIRVeQ
  function __f_3(){
    'use asm';
    function __f_5() {
      __v_10 = __v_3;
      var __v_10 = 0;
      var __v_3 = 0
    }
    return { __f_5: __f_5 };
  }
  var __v_11 = Wasm.instantiateModuleFromAsm(__f_3.toString());


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot