Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5982657764917248

Fuzzer: mbarbella_js_mutation
Job Type: windows_asan_d8
Platform Id: windows

Crash Type: Fatal error
Crash Address: 
Crash State:
  
  V8_Fatal
  v8::internal::wasm::AsmWasmBuilderImpl::VisitLiteral
  v8::internal::wasm::AsmWasmBuilderImpl::VisitBinaryOperation
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_d8&range=421045:421431

Minimized Testcase (0.40 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95IJ8lPo3Tq7eN6QhKSPdMVZvTujPBVZx9QkrWHV--ovcBemX3EavwLAB_SVp4sa3LyVGwa_0yHhbawJn9jSK9jEkFQkBYhN6olaTWkMA4A0FHMathNIExkBToi5Mg6nizp4_tUzJbOFrZF1pCKbBjvfrakDw?testcase_id=5982657764917248
  1, function () {
  }();
function __f_1() {
  function __f_2() {
    "use asm";
    FUNC_BODY
    return {main: FUNC_NAME};
  }
  var __v_2 = __f_2.toString()
    .replace(/FUNC_BODY/g, func.toString())
    .replace(/FUNC_NAME/g, func.name);
  return eval("(" + __v_2 + ")");
}
function __f_16() {
}
function __f_21(a) {
  a = a | 0;
-a | 0;
}
__v_9 = [ __f_21];
  for (func of __v_9) {
__f_1(), {
    };
  }


Issue manually filed by: brajkumar

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.