This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This is specific to WebAssembly. Looks like the target of a call is not a {Code} object but some zapped handled. Most likely related to async compilation (i.e. only reproduces with the --wasm-async-compilation flag). Regression range points to b29bfffdf9d3c393b98486504ddd7a073a2e0280, but that might be a red herring.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/045c40d09c9320984bd57d39d68b174099697d1d

commit 045c40d09c9320984bd57d39d68b174099697d1d
Author: Mircea Trofin <mtrofin@chromium.org>
Date: Tue Jun 20 22:22:56 2017

[wasm] Reopen CEntryStub handle in deferred scope when async compiling.

Bug:  chromium:734108 
Change-Id: I696b104e3b6b9dd71a60c21baa558d4f1fec1dfb
Reviewed-on: https://chromium-review.googlesource.com/541624
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46074}
[modify] https://crrev.com/045c40d09c9320984bd57d39d68b174099697d1d/src/compiler/wasm-compiler.h
[modify] https://crrev.com/045c40d09c9320984bd57d39d68b174099697d1d/src/wasm/module-compiler.cc
[add] https://crrev.com/045c40d09c9320984bd57d39d68b174099697d1d/test/mjsunit/regress/wasm/regression-734108.js

 Issue 735270  has been merged into this issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot