Clemens agreed to take a look. Feel free to WontFix if this OOM in the WASM-interpreter is not actionable. Thanks!

Turns out it's not an OOM, but an uint underflow.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/4423c9cc099d639e774023e9cb7aa90bccb0d364

commit 4423c9cc099d639e774023e9cb7aa90bccb0d364
Author: Clemens Hammacher <clemensh@chromium.org>
Date: Wed May 03 11:35:09 2017

[wasm] [interpreter] Ignore stack effects after unreachable

During computation of the side table, ignore stack effects of
instructions following any unconditional jump in the same block
(|unreachable|, |br|, |br_table| or |return| jump out of the block).
Without this fix, the current stack height might underflow, or we compute an
unnecessarily large max_stack_height_. Note that those instruction will
never get executed anyway.
Hence, we don't need to store any side table information for such
unreachable code.

R=rossberg@chromium.org
BUG= chromium:716936 ,  chromium:715990 

Change-Id: I282f7f18ba1b972a112210e692f6cd05cf32308c
Reviewed-on: https://chromium-review.googlesource.com/493266
Reviewed-by: Andreas Rossberg <rossberg@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45059}
[modify] https://crrev.com/4423c9cc099d639e774023e9cb7aa90bccb0d364/src/wasm/wasm-interpreter.cc
[modify] https://crrev.com/4423c9cc099d639e774023e9cb7aa90bccb0d364/src/wasm/wasm-opcodes.cc
[modify] https://crrev.com/4423c9cc099d639e774023e9cb7aa90bccb0d364/src/wasm/wasm-opcodes.h
[modify] https://crrev.com/4423c9cc099d639e774023e9cb7aa90bccb0d364/test/cctest/wasm/test-run-wasm.cc
[modify] https://crrev.com/4423c9cc099d639e774023e9cb7aa90bccb0d364/test/unittests/wasm/control-transfer-unittest.cc

ClusterFuzz has detected this issue as fixed in range 469010:469082.

Detailed report: https://clusterfuzz.com/testcase?key=6093735298596864

Fuzzer: libfuzzer_v8_wasm_call_fuzzer
Job Type: libfuzzer_chrome_msan
Platform Id: linux

Crash Type: Out-of-memory (exceeds 2048 MB)
Crash Address: 
Crash State:
  NULL
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=467522:467551
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_msan&range=469010:469082

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6093735298596864


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.