Regression range points to 549692cbc0ab4e9929e6e5f13db879072b119fb0.

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This is not a security regression because it requires a testing flag.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/44c400eeafd525c4706ad3851ca0b43fae1bdfe2

commit 44c400eeafd525c4706ad3851ca0b43fae1bdfe2
Author: Andreas Haas <ahaas@chromium.org>
Date: Thu Oct 05 15:11:02 2017

[wasm] Fail upon second code section in streaming compilation

At the moment we check only in the module-decoder if the sections in a
module appear at most once. The code section, however, we process
already before this check. With this CL we check that there is at most
one code section before we start processing it.

R=clemensh@chromium.org
TEST=WasmStreamingDecoderTest.TwoCodeSections

Bug:  chromium:771916 
Change-Id: Icc79d5a87ab39f450a35c688f74ea5e67cae4b3c
Reviewed-on: https://chromium-review.googlesource.com/702379
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48314}
[modify] https://crrev.com/44c400eeafd525c4706ad3851ca0b43fae1bdfe2/src/wasm/streaming-decoder.cc
[modify] https://crrev.com/44c400eeafd525c4706ad3851ca0b43fae1bdfe2/src/wasm/streaming-decoder.h
[modify] https://crrev.com/44c400eeafd525c4706ad3851ca0b43fae1bdfe2/test/unittests/wasm/streaming-decoder-unittest.cc

ClusterFuzz has detected this issue as fixed in range 48313:48314.

Detailed report: https://clusterfuzz.com/testcase?key=5488266068623360

Fuzzer: ochang_js_fuzzer
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  units_.empty() in module-compiler.cc
  ~CompilationUnitBuilder
  v8::internal::wasm::AsyncStreamingProcessor::ProcessCodeSectionHeader
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=48021:48022
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=48313:48314

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5488266068623360

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5488266068623360 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot