This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

A friendly reminder that M57 Beta launch is coming soon on February 2nd! Your bug is labelled as Beta ReleaseBlock, pls make sure to land the fix and get it merged into the release branch (2987) ASAP so it gets enough baking time in Dev (before Beta promotion). Thank you!

gdeepti@, bradnelson@: There's another WebAssembly.Memory() issue at  Issue 682909 ; could you help triage and dedup if they're related?

The fix for this issue landed in V8 - https://chromium.googlesource.com/v8/v8/+/6934db7ca7777db0799ec76b3fae811734e3c5c2 and was rolled into Chrome, but it looks like this commit rolled back the version of v8 in chrome - https://chromium.googlesource.com/chromium/src/+/390433475ddec8e91e0fbc6055a76f3bd2783c93 to a version of v8 that does not have the fix for the issue above, causing clusterfuzz to detect this. The fix is in the version of v8 that is in chrome as of today so marking this as fixed so clusterfuzz can verify. 

ClusterFuzz has detected this issue as fixed in range 445054:445058.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4814570096164864

Fuzzer: v8_builtins_generator
Job Type: windows_asan_d8
Platform Id: windows

Crash Type: UNKNOWN READ
Crash Address: 0x7ff80003
Crash State:
  v8::internal::wasm::GrowWebAssemblyMemory
  v8::WebAssemblyMemoryGrow
  v8::internal::FunctionCallbackArguments::Call
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_d8&range=444720:444724
Fixed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_d8&range=445054:445058

Minimized Testcase (0.09 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95Aagpchj-8T5fPD3MMZN3GZEl0BKYQCebQrTbi2gjK700jwwHmlO59loUMdZr84ORIVzAOCVZm23J48Ei-S6Gj7m2nzxZvPTJscEzw5Ul6me59tyYsKrb2oI6EY3vcBy5-N93j-OHwizuNDE1ztj9cnmHTbizTwFKNY_RBe1wev6mbq-g6NQLYFUmkw65nd64S4ViC7Pl-Z5lWHm7-J1UMD8az2ubkuEGmAnPbhLr8P1zoN0kQ1vNVaGKWU7akIoHLF9kKbQjmrUsW2_paWazR9RpsWExmCZ4r8UoyhdpQlTDdLlWBKFxU6wypeKzjeRGQOOICpw1Fod3FZ48f6mKRmAHAuxAXleJKpQ5p1oi6tM_xi-Y?testcase_id=4814570096164864
var v3 = {};
var v57 = {};
 v68 = new WebAssembly.Memory(v57); 
 v72 = v68.grow( v3); 


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot