This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Looks like a asm2wasm issue. The regression range points to 02149d89a5a9715309d3fc786466224958a66c9c, but I have the strong suspicion that is a red herring. Feel free to re-assign to Adam if the issue is indeed related.

Please note that as this bug is marked as ReleaseBlock-Beta for M57, changes needs to be on trunk by this Friday, 1/27, to make the M57 branch. Please prioritise accordingly. Thanks!

[Bulk edit]

A friendly reminder that M57 Beta launch is coming soon on February 2nd (in a week)! Your bug is labelled as Beta ReleaseBlock, pls make sure to land the fix and get it merged into the release branch (2987) ASAP so it gets enough baking time in Dev (before Beta promotion). Thank you!

ClusterFuzz has detected this issue as fixed in range 42691:42692.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6429013942992896

Fuzzer: mbarbella_js_mutation
Job Type: linux_asan_d8_ignition_v8_arm_dbg
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0xda20001c
Crash State:
  v8::internal::FixedArray::set
  v8::internal::WasmInstanceWrapper::New
  v8::internal::WasmInstanceObject::New
  
Sanitizer: address (ASAN)

Recommended Security Severity: Medium

Regressed: V8: 42110:42111
Fixed: V8: 42691:42692

Minimized Testcase (0.56 Kb): https://cluster-fuzz.appspot.com/download/AMIfv940LMmK1TwtNDGznYHZNuZCRXjS2lQm6anQcC8TDOMXoAb39mH2lfuXv_LGBU9oAmivamLQBSVsF_ynCNVm_jhEJglpPIgndiB_P5Y9dpz8w2aKD0EYRvfXU14Rl16xFm1Cx3h7_wPx1rUegNx84NJk7pIBmIzxyb9WZEFsyC9X7iovskY5VLg_KVGS2DhWF-Lk5AJw1FYZM4EQyYckEnNzbbi9jrU-hXYOmB0p4KW1PHff53t85dIzxfFu51CMIUc94syVblIXwrtI-Nxmmj7veUBQlEc7Xk09PrlfJkpF-vC_Fo4MyJzQa9Bmj2FsvsKtwL-e193Ci6L4KmOvJH7_vYnyRL6RI3O5T3UrPixG79VxGSo?testcase_id=6429013942992896

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6429013942992896 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Anything in the v8 fix range (42691:42692) we should be merging to 57?

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot