Bisects to https://chromium.googlesource.com/v8/v8/+log/8e5ac62ddf17e85027b4eeb1056cddfbb70cace8..b4dc310aab9b8aae362bcc226a9b0bb160ed2450?pretty=fuller

Fix available in https://codereview.chromium.org/2347333002/. 
Waiting for 0xC to land 1st

 Issue 650583  has been merged into this issue.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/df490c348433186f98bca50670b0b9094bd06ca1

commit df490c348433186f98bca50670b0b9094bd06ca1
Author: mtrofin <mtrofin@chromium.org>
Date: Thu Sep 29 00:48:11 2016

[wasm] Fix for cloning module heap size value

The module size is encoded as a HeapNumber, and needs to be
explicitly cloned.

BUG= chromium:647649 

Review-Url: https://codereview.chromium.org/2347333002
Cr-Commit-Position: refs/heads/master@{#39845}

[modify] https://crrev.com/df490c348433186f98bca50670b0b9094bd06ca1/src/wasm/wasm-module.cc
[add] https://crrev.com/df490c348433186f98bca50670b0b9094bd06ca1/test/mjsunit/regress/wasm/regression-647649.js

ClusterFuzz has detected this issue as fixed in range 39844:39845.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5380135836712960

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_arm64_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  old_size == 0 || wasm_memory_size_reference() <= old_size in assembler.cc
  
Regressed: V8: r39360:39361
Fixed: V8: r39844:39845

Minimized Testcase (0.88 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96od_JK07XLn5ekWmWvpKb9Ezs1aNm1JvpKOd9cL9qw-uvh-ChxwhX_wFPwIF-QEjcWJctFJ5Sz4MD3Ho5JYwCb9rmK0nwP6TsUZKPKRms2BoWnQ67K_pV_pNBouQsui9nkub2hs1eajFRYoItwuALqtUFKEw?testcase_id=5380135836712960

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot