Only reproduces with --wasm-interpret-all, hence lowering priority. Could be the same as  issue 735448 . Note that the regression range points to a more recent change, but I suspect that just flushed it out. Hits the following assertion in debug mode ...

#
# Fatal error in ../src/wasm/wasm-interpreter.cc, line 636
# Debug check failed: Code::WASM_TO_JS_FUNCTION == js_wrapper->kind() (8 vs. 10).
#

ClusterFuzz has detected this issue as fixed in range 491244:491285.

Detailed report: https://clusterfuzz.com/testcase?key=6571099956707328

Fuzzer: inferno_js_fuzzer
Job Type: windows_asan_d8
Platform Id: windows

Crash Type: CHECK failure
Crash Address: 
Crash State:
  deopt_data->get(1)->ToInt32(&index) in wasm-interpreter.cc
  v8::platform::PrintStackTrace
  v8::internal::wasm::ThreadImpl::CallCodeObject
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_d8&range=489609:489657
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_d8&range=491244:491285

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6571099956707328


See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6571099956707328 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot