https://chromium-review.googlesource.com/509574

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/70a43f4d3dccf5b4079459f14423d0d9f1c13d80

commit 70a43f4d3dccf5b4079459f14423d0d9f1c13d80
Author: Clemens Hammacher <clemensh@chromium.org>
Date: Tue May 23 09:47:56 2017

[wasm] Validate function bodies for lazy compilation

Validation normally happens while generating the turbofan graph of a
wasm function. For lazy compilation (behind the flag
--wasm-lazy-compilation), we skip this graph generation step during
module generation. Thus we need to validate explicitely.

R=ahaas@chromium.org
BUG= chromium:724851 

Change-Id: Ic70887c0d823460a272d0bb636dc98b2b7a7e55e
Reviewed-on: https://chromium-review.googlesource.com/509574
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45478}
[modify] https://crrev.com/70a43f4d3dccf5b4079459f14423d0d9f1c13d80/src/wasm/wasm-module.cc
[add] https://crrev.com/70a43f4d3dccf5b4079459f14423d0d9f1c13d80/test/mjsunit/regress/wasm/regression-724851.js

ClusterFuzz has detected this issue as fixed in range 45477:45478.

Detailed report: https://clusterfuzz.com/testcase?key=6396053053243392

Fuzzer: inferno_js_fuzzer
Job Type: linux_asan_d8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !thrower.error() in wasm-module.cc
  v8::internal::wasm::LazyCompilationOrchestrator::CompileFunction
  v8::internal::wasm::LazyCompilationOrchestrator::CompileLazy
  
Sanitizer: address (ASAN)

Regressed: V8: 45160:45161
Fixed: V8: 45477:45478

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6396053053243392


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.