One more null pointer deref.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/853892a516d3840c7dbec678310817778f09923b

commit 853892a516d3840c7dbec678310817778f09923b
Author: ahaas <ahaas@chromium.org>
Date: Thu Sep 08 14:40:34 2016

[wasm] Do not produce code for br_if if its condition does not validate.

I could not reproduce the bug in either a unittest nor a cctest. That's
why I created an mjsunit test now.

BUG= chromium:644682 
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2319213003
Cr-Commit-Position: refs/heads/master@{#39282}

[modify] https://crrev.com/853892a516d3840c7dbec678310817778f09923b/src/wasm/ast-decoder.cc
[add] https://crrev.com/853892a516d3840c7dbec678310817778f09923b/test/mjsunit/wasm/regression-644682.js

ClusterFuzz has detected this issue as fixed in range 417297:417419.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6425017007210496

Fuzzer: afl_v8_wasm_code_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000008
Crash State:
  v8::internal::compiler::WasmGraphBuilder::AppendToPhi
  v8::internal::wasm::WasmFullDecoder::CreateOrMergeIntoPhi
  v8::internal::wasm::WasmFullDecoder::BreakTo
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=415614:415641
Fixed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=417297:417419

Minimized Testcase (0.12 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95HD0mFJBOuIGuELVj8mDH7IbCoNxerPcP1R7hdrcl656CRY191KKbUwAHcTRadwhfZMgutZWjDyWOYCneDYljKUdN3HOg7lCfsdfvUnxJzddtvbVG01u_nirEWc3zUaMoRuIWjBjly5KyjrM-pc6p3lrnS1w?testcase_id=6425017007210496

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot