This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This is due to an ArrayBuffer with a size exceeding the uint32_t range on 64-bit systems. WebAssembly is not prepared to handle that. Will look into making this fail gracefully. No security impact thought, safe crash even in release mode.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/8d2a8e0c05853b5743fd51076d9c4d98dba206e2

commit 8d2a8e0c05853b5743fd51076d9c4d98dba206e2
Author: Michael Starzinger <mstarzinger@chromium.org>
Date: Fri Aug 25 09:52:58 2017

[asm.js] Fail gracefully on overly large buffers.

This makes sure instantiate of asm.js modules fails gracefully on heap
buffers exceeding the uint32_t range supported by WebAssembly.

R=clemensh@chromium.org
TEST=mjsunit/regress/regress-crbug-754175
BUG= chromium:754175 

Change-Id: I4a9c6791beaab6da826b5b6b5a495f97e9d3b4e9
Reviewed-on: https://chromium-review.googlesource.com/632618
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47598}
[modify] https://crrev.com/8d2a8e0c05853b5743fd51076d9c4d98dba206e2/src/asmjs/asm-js.cc
[add] https://crrev.com/8d2a8e0c05853b5743fd51076d9c4d98dba206e2/test/mjsunit/regress/regress-crbug-754175.js

ClusterFuzz has detected this issue as fixed in range 497443:497481.

Detailed report: https://clusterfuzz.com/testcase?key=6222338663383040

Fuzzer: decoder_langfuzz
Job Type: linux_ubsan_vptr_d8
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  memory->byte_length()->ToUint32(&mem_size) in module-compiler.cc
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_d8&range=488740:489609
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_d8&range=497443:497481

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6222338663383040

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6222338663383040 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot