Suspected cl:https://chromium.googlesource.com/v8/v8/+/974f4a8059ba27f1298c0050067eb7a9ca575b81%5E%21/src/asmjs/asm-typer.cc

jpp@ could you please look into this. Thanks

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/a25e9c6f970fdcead8faffd1b7cc64b6d1f78a49

commit a25e9c6f970fdcead8faffd1b7cc64b6d1f78a49
Author: jpp <jpp@chromium.org>
Date: Fri Jul 15 16:09:41 2016

V8. ASM-2-WASM. Fixes  issue 628446 .

The issue was caused by a mishandling of "special" identifiers, i.e.,
the module's name, and the module's parameter.

BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=628446
BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST= cctest/asmjs/test-asm-typer.cc
TEST= cctest/wasm/*
LOG=N

Review-Url: https://codereview.chromium.org/2147403002
Cr-Commit-Position: refs/heads/master@{#37800}

[modify] https://crrev.com/a25e9c6f970fdcead8faffd1b7cc64b6d1f78a49/src/asmjs/asm-typer.cc
[modify] https://crrev.com/a25e9c6f970fdcead8faffd1b7cc64b6d1f78a49/src/asmjs/asm-typer.h
[modify] https://crrev.com/a25e9c6f970fdcead8faffd1b7cc64b6d1f78a49/test/cctest/asmjs/test-asm-typer.cc

ClusterFuzz has detected this issue as fixed in range 37799:37800.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5075305798828032

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_ignition_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !proxy_info->type()->IsA(AsmType::None()) in asm-typer.cc
  
Regressed: V8: r37728:37729
Fixed: V8: r37799:37800

Minimized Testcase (0.27 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv97sYoHffGoW7Q5dBA64kUP27FRo9WsrG5fiqYcDnBtS1yQjGL8349cno4Sa1gmdYgdh5b3CDwg5A7Zei6bSQNC6Aivq6L-XqbF7Wn_soZ8QFQ6JFQw3i3ib_u2_6SQo8He5PHBMQVcxRhig0rTe-3bmeTAKmA?testcase_id=5075305798828032
try {
( {
  })();
(function() {
})();
} catch(e) {; }
function __f_64(expected, __f_81, __f_12) {
 Wasm.instantiateModuleFromAsm( __f_81.toString());
}
function __f_63() {
  "use asm"
  function __f_24() {
 __f_63;
  }
}
__f_64(41, __f_63);
( {
})();
(function __f_65() {
})();


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot