looks this is the suspected :

https://chromium.googlesource.com/v8/v8/+/b4dc310aab9b8aae362bcc226a9b0bb160ed2450%5E%21/src/wasm/wasm-module.cc

mtrofin@ could you please look into this.please feel free to re-assigned back if needed. thanks in advance !

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/c938f0df224b49d805503bbad98c4180f014e11a

commit c938f0df224b49d805503bbad98c4180f014e11a
Author: mtrofin <mtrofin@chromium.org>
Date: Tue Oct 04 21:23:02 2016

[wasm] explicitly mark off unlinked wasm module instances

This fixes a gc stress bug. We cannot rely on an ordering of
clearing of the weak cells, so we explicitly reset the weak
link to the owning instance, when finalizing a compiled
module. In turn, this serves as a reliable signal when GCs
happen while instantiating, allowing us to correctly link the
new instance.

BUG= chromium:652425 

Review-Url: https://codereview.chromium.org/2393443003
Cr-Commit-Position: refs/heads/master@{#39964}

[modify] https://crrev.com/c938f0df224b49d805503bbad98c4180f014e11a/src/wasm/wasm-module.cc
[add] https://crrev.com/c938f0df224b49d805503bbad98c4180f014e11a/test/mjsunit/regress/wasm/regression-02256.js

ClusterFuzz has detected this issue as fixed in range 39963:39964.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5304392368783360

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !next->cleared() in wasm-module.cc
  
Regressed: V8: r39889:39890
Fixed: V8: r39963:39964

Minimized Testcase (20.39 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97EcGXVu-iXy4JkYEt88OoEfcNMHHrFQ7OA-_cmn82KFwscogiOI8QEN61815P5k7gezYb6vglI1A28VaDEmAM_B9bIn4j0ierevqw7Yh9m-YrGzNhaWQA3L0lDj382KzLlE-PGF09OB3e8U0NwYdEE9l53Hpd3MCftk_trU39tcO_Gf0A?testcase_id=5304392368783360

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase is verified as fixed, closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot