Andreas, I'm not sure that this bug is not a duplicate of any of the others.

Question to CC'ed folks: why don't we have symbolized stacktraces for crashes like this? I think we haven't changed anything recently?

The problem here is that the wasm-compiler currently cannot deal with SIMD128 values in the signature of imports.

Hi Deepti,
Can you take care of this bug? I managed to fix the problem I stated above, but then there are more follow-up problems.
Thanks, Andreas

ClusterFuzz has detected this issue as fixed in range 421457:421501.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6410376050900992

Fuzzer: afl_v8_wasm_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: Fatal error
Crash Address: 
Crash State:
  NULL
Regressed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=415614:415641
Fixed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=421457:421501

Minimized Testcase (0.08 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97DBxRKMGOq5y9nrOZuh78djv2h3HxaR1JeO8xP3lBNcX1_CcUBuMZNgsKEJS1N0NquNXZLniaduafw2YAGPrhuFCh3HA8ZygwD-F6odcpHi6dOivxuHObpUO1snyTQw5mUYCYBfONYvQdwGpCCbj5GeId98Q?testcase_id=6410376050900992

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

 Issue 652447  has been merged into this issue.

This issue is not fixed, see https://cluster-fuzz.appspot.com/testcase?key=6653828328062976

The reason why the ClusterFuzz report changed is the change to the 0xc binary format.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/19dab886a4013761fa9266fd21fd755a172cd3eb

commit 19dab886a4013761fa9266fd21fd755a172cd3eb
Author: gdeepti <gdeepti@chromium.org>
Date: Fri Oct 07 07:52:06 2016

[wasm] Simd128 types should not be available in asmjs modules.
 - Added gating code in the module-decoder to allow SIMD code only when
 it can be decoded correctly
 - SIMD128 values should not be exported to JS
 - Try/Catch should not be available in asmjs modules
 - Trivial fixes for S128  values

BUG= chromium:648079 

R=ahaas@chromium.org, titzer@chromium.org, bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2400863003
Cr-Commit-Position: refs/heads/master@{#40067}

[modify] https://crrev.com/19dab886a4013761fa9266fd21fd755a172cd3eb/src/compiler/wasm-compiler.cc
[modify] https://crrev.com/19dab886a4013761fa9266fd21fd755a172cd3eb/src/compiler/wasm-compiler.h
[modify] https://crrev.com/19dab886a4013761fa9266fd21fd755a172cd3eb/src/wasm/ast-decoder.cc
[modify] https://crrev.com/19dab886a4013761fa9266fd21fd755a172cd3eb/src/wasm/ast-decoder.h
[modify] https://crrev.com/19dab886a4013761fa9266fd21fd755a172cd3eb/src/wasm/module-decoder.cc
[add] https://crrev.com/19dab886a4013761fa9266fd21fd755a172cd3eb/test/mjsunit/regress/wasm/regression-648079.js
[modify] https://crrev.com/19dab886a4013761fa9266fd21fd755a172cd3eb/test/mjsunit/wasm/wasm-constants.js

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot