Assigning to concern owner from Predator results --
The result is a list of CLs that change the crashed files. 

Author: Andreas Haas
Project: chromium-v8
Changelist: https://chromium.googlesource.com/v8/v8.git/+/a15030304ac030262f6a59e24d5833251fe4db8a
Time: Wed Jun 28 12:04:42 2017
File module-decoder.cc is changed in this cl (and is part of stack frame #3, "DecodeCodeSection"; frame #4, "v8::internal::wasm::"; frame #5, "DecodeModule"; frame #6, "v8::internal::wasm::DecodeWasmModule")
Minimum distance from crash line to modified line: 1. (file: module-decoder.cc, crashed on: 672, modified: 673).

@Andreas Haas -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

The problem is a DCHECK which comes right before the actual error handling. Without the DCHECK the code would have behaved correctly.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/6c8aed76ff89d4dca4cefa778b90d511429bc36c

commit 6c8aed76ff89d4dca4cefa778b90d511429bc36c
Author: Andreas Haas <ahaas@chromium.org>
Date: Thu Jul 06 12:03:09 2017

[wasm] Check the size of a function body before storing it

We stored the size of a function body before we check that
these values are valid. This caused a failing DCHECK in the constructor
of WireBytesRef which checked for integer overflows. With this CL we
check the size of the function body before we create the WireBytesRef.

R=clemensh@chromium.org

Bug:  chromium:738097 
Change-Id: I18f8b628c1499aae9c8e9340ea73c87f19e6f1d7
Reviewed-on: https://chromium-review.googlesource.com/561000
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46442}
[modify] https://crrev.com/6c8aed76ff89d4dca4cefa778b90d511429bc36c/src/wasm/module-decoder.cc
[modify] https://crrev.com/6c8aed76ff89d4dca4cefa778b90d511429bc36c/test/unittests/wasm/module-decoder-unittest.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/2f8bb6cdf45960c809c2f4b9a525e089ce985628

commit 2f8bb6cdf45960c809c2f4b9a525e089ce985628
Author: Michael Achenbach <machenbach@chromium.org>
Date: Thu Jul 06 12:52:00 2017

Revert "[wasm] Check the size of a function body before storing it"

This reverts commit 6c8aed76ff89d4dca4cefa778b90d511429bc36c.

Reason for revert: Breaks some debug bots:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug/builds/16754
https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20debug/builds/17654

Original change's description:
> [wasm] Check the size of a function body before storing it
> 
> We stored the size of a function body before we check that
> these values are valid. This caused a failing DCHECK in the constructor
> of WireBytesRef which checked for integer overflows. With this CL we
> check the size of the function body before we create the WireBytesRef.
> 
> R=​clemensh@chromium.org
> 
> Bug:  chromium:738097 
> Change-Id: I18f8b628c1499aae9c8e9340ea73c87f19e6f1d7
> Reviewed-on: https://chromium-review.googlesource.com/561000
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46442}

TBR=ahaas@chromium.org,clemensh@chromium.org

Change-Id: Ifd533c0dee369c746bc97fea13275ebc09ed5eff
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  chromium:738097 
Reviewed-on: https://chromium-review.googlesource.com/561517
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46445}
[modify] https://crrev.com/2f8bb6cdf45960c809c2f4b9a525e089ce985628/src/wasm/module-decoder.cc
[modify] https://crrev.com/2f8bb6cdf45960c809c2f4b9a525e089ce985628/test/unittests/wasm/module-decoder-unittest.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/641705e0c088114e2201b075653f9711a5c6bb09

commit 641705e0c088114e2201b075653f9711a5c6bb09
Author: Andreas Haas <ahaas@chromium.org>
Date: Thu Jul 06 17:37:57 2017

Reland [wasm] Check the size of a function body before storing it

In the original CL I moved an error check backwards, unfortunately
behind a vector lookup which should not happen when there is an error.
Now I also move the vector lookup backwards.

Original message:
We stored the size of a function body before we check that
these values are valid. This caused a failing DCHECK in the constructor
of WireBytesRef which checked for integer overflows. With this CL we
check the size of the function body before we create the WireBytesRef.

R=clemensh@chromium.org

Bug:  chromium:738097 
Change-Id: Ie65b3cfcbcd6bdb3f04b0760673d9c7b7a0d1057
Reviewed-on: https://chromium-review.googlesource.com/561519
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46453}
[modify] https://crrev.com/641705e0c088114e2201b075653f9711a5c6bb09/src/wasm/module-decoder.cc
[modify] https://crrev.com/641705e0c088114e2201b075653f9711a5c6bb09/test/unittests/wasm/module-decoder-unittest.cc

ClusterFuzz has detected this issue as fixed in range 485233:485271.

Detailed report: https://clusterfuzz.com/testcase?key=5728254333026304

Fuzzer: libFuzzer_v8_wasm_async_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  offset_ <= offset_ + length_ in wasm-module.h
  WireBytesRef
  DecodeCodeSection
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=483010:483203
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=485233:485271

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5728254333026304


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5728254333026304 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.