This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Assigning to current v8 clusterfuzz sheriff. Regression range points to https://chromium.googlesource.com/v8/v8/+/9884fb91e15e5e85218886b67af410668a08c38b, but obviously that isn't the root cause.

The issue seems to be Wasm related, please investigate.

ClusterFuzz has detected this issue as fixed in range 42431:42432.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5712436767490048

Fuzzer: v8_builtins_generator
Job Type: linux_asan_d8
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x00000b400038
Crash State:
  v8::internal::HeapObject::GetIsolate
  Handle
  handle<v8::internal::WasmInstanceObject>
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: V8: r42266:42267
Fixed: V8: r42431:42432

Minimized Testcase (0.12 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95PPEzYfq9CrwqC3R-OQQV5vsp7Al_98ekL1RqRVdZGZa7HXdZnhX6lu9SOPALjl-XByZynK-TCLtV8ZhOD8xyuJU88E8jZczt91U37_fU8kco0dupzWuVPDJTU77Wp-zIkZGRAsvv2_lhGSA47h3ddekxYTokp9Xks4YF-_GQZdFj0l8SirA4l_7zxYuTD7ef4vWkD9sBL6kzqjGJIsdAbGVpmEsvHijJWBi3VUV_8P99ipzBPTbgKHmm_3hXdbK3VxQmc5lnJqFc-LLGKGSiz0jamq8wGz_8kRb5E3GzjY8MFmamFfoql025cn6vaIsCFsO9YuPRGMeC3vT1zDbBqxLNi6AGG5ZyRlBoenWKzdWIIhu5Sysd_PDdgJx_dpj9190Yc_RtcqVrScKBMTA9LtNvPsg?testcase_id=5712436767490048
 v6 = Array(0x8000).join(); 
 v9 = new Worker(v6); 
var v10 = {};
 v15 = new WebAssembly.Memory(v10); 
 v22 = v15.grow(v15); 


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot