WASM fuzzer.

Thanks Penny, I will take a look.

This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/57d81937647e85596f04dd1c2c02e2044f6f5e63

commit 57d81937647e85596f04dd1c2c02e2044f6f5e63
Author: ahaas <ahaas@chromium.org>
Date: Tue Sep 20 14:03:08 2016

[wasm] Fix EnsureSpace in the ZoneBuffer of the wasm encoder.

BUG= chromium:647329 
R=titzer@chromium.org
TEST=unittest EncoderTest.Regression_647329

Review-Url: https://codereview.chromium.org/2355803002
Cr-Commit-Position: refs/heads/master@{#39556}

[modify] https://crrev.com/57d81937647e85596f04dd1c2c02e2044f6f5e63/src/wasm/encoder.h
[modify] https://crrev.com/57d81937647e85596f04dd1c2c02e2044f6f5e63/test/unittests/wasm/encoder-unittest.cc

ClusterFuzz has detected this issue as fixed in range 419991:420032.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5456208398123008

Fuzzer: afl_v8_wasm_names_section_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: Use-after-poison WRITE {*}
Crash Address: 0x62d000018410
Crash State:
  fuzz_wasm_section
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=418794:418831
Fixed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=419991:420032

Minimized Testcase (16.23 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94r03xsWD3ZIZ6UOdx90A5qDpQA-cFKNlier-CgFp-D6YAHu-KzgFrz4nxHotqSDm--5Fs-2PG67CHsgGoa1Ox_3u5m-8h76VXAqQQpTShF2TlqmVj0N60muIofpoty3HLCOyDqXnafp4-j1S7i5WbJVg1bG_w37iHen_RrKMCxa_717m4?testcase_id=5456208398123008

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz has detected this issue as fixed in range 419991:420032.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5456208398123008

Fuzzer: afl_v8_wasm_names_section_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: Use-after-poison WRITE {*}
Crash Address: 0x62d000018410
Crash State:
  fuzz_wasm_section
  
Recommended Security Severity: High

Regressed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=418794:418831
Fixed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=419991:420032

Minimized Testcase (16.23 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94r03xsWD3ZIZ6UOdx90A5qDpQA-cFKNlier-CgFp-D6YAHu-KzgFrz4nxHotqSDm--5Fs-2PG67CHsgGoa1Ox_3u5m-8h76VXAqQQpTShF2TlqmVj0N60muIofpoty3HLCOyDqXnafp4-j1S7i5WbJVg1bG_w37iHen_RrKMCxa_717m4?testcase_id=5456208398123008

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot