Another failure for --wasm-interpret-all.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/236298acbf07767d2c9363427d1c99eb313a6143

commit 236298acbf07767d2c9363427d1c99eb313a6143
Author: Clemens Hammacher <clemensh@chromium.org>
Date: Fri Nov 17 16:28:38 2017

[wasm] Unify deoptimization data

Add methods to add deoptimization data and use them from all the places
where we currently add them manually. Also add them to wasm-to-wasm
wrappers compiled on table set, which was missing before, leading to
the referenced bug.

Drive-by: Disable non-applicable MaybeHandle constructors to allow
overloading functions with different Handle types.

R=ahaas@chromium.org

Bug:  chromium:779292 
Change-Id: Ib9132d9faeb1092c46e22dd8196d201ce5c0942f
Reviewed-on: https://chromium-review.googlesource.com/774838
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49452}
[modify] https://crrev.com/236298acbf07767d2c9363427d1c99eb313a6143/src/compiler/wasm-compiler.cc
[modify] https://crrev.com/236298acbf07767d2c9363427d1c99eb313a6143/src/compiler/wasm-compiler.h
[modify] https://crrev.com/236298acbf07767d2c9363427d1c99eb313a6143/src/wasm/module-compiler.cc
[modify] https://crrev.com/236298acbf07767d2c9363427d1c99eb313a6143/src/wasm/wasm-objects.cc
[modify] https://crrev.com/236298acbf07767d2c9363427d1c99eb313a6143/test/mjsunit/wasm/interpreter.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/16943d2d713ea29beadc9994abf78bfcc2617c66

commit 16943d2d713ea29beadc9994abf78bfcc2617c66
Author: Adam Klein <adamk@chromium.org>
Date: Fri Nov 17 17:27:46 2017

Revert "[wasm] Unify deoptimization data"

This reverts commit 236298acbf07767d2c9363427d1c99eb313a6143.

Reason for revert: suspected cause of failures on GC stress bots:

https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/16341
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/16269

Original change's description:
> [wasm] Unify deoptimization data
> 
> Add methods to add deoptimization data and use them from all the places
> where we currently add them manually. Also add them to wasm-to-wasm
> wrappers compiled on table set, which was missing before, leading to
> the referenced bug.
> 
> Drive-by: Disable non-applicable MaybeHandle constructors to allow
> overloading functions with different Handle types.
> 
> R=​ahaas@chromium.org
> 
> Bug:  chromium:779292 
> Change-Id: Ib9132d9faeb1092c46e22dd8196d201ce5c0942f
> Reviewed-on: https://chromium-review.googlesource.com/774838
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49452}

TBR=ahaas@chromium.org,clemensh@chromium.org

Change-Id: I02fb49d2ece8e04ac5fb26f618bfe6fb2f133d06
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  chromium:779292 
Reviewed-on: https://chromium-review.googlesource.com/777079
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49455}
[modify] https://crrev.com/16943d2d713ea29beadc9994abf78bfcc2617c66/src/compiler/wasm-compiler.cc
[modify] https://crrev.com/16943d2d713ea29beadc9994abf78bfcc2617c66/src/compiler/wasm-compiler.h
[modify] https://crrev.com/16943d2d713ea29beadc9994abf78bfcc2617c66/src/wasm/module-compiler.cc
[modify] https://crrev.com/16943d2d713ea29beadc9994abf78bfcc2617c66/src/wasm/wasm-objects.cc
[modify] https://crrev.com/16943d2d713ea29beadc9994abf78bfcc2617c66/test/mjsunit/wasm/interpreter.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/3380e9a4d92a67881c4ff9d83e6d7d5b85a79750

commit 3380e9a4d92a67881c4ff9d83e6d7d5b85a79750
Author: Clemens Hammacher <clemensh@chromium.org>
Date: Mon Nov 20 17:37:01 2017

Reland "[wasm] Unify deoptimization data"

This is a reland of 236298acbf07767d2c9363427d1c99eb313a6143.

Original change's description:
> [wasm] Unify deoptimization data
>
> Add methods to add deoptimization data and use them from all the places
> where we currently add them manually. Also add them to wasm-to-wasm
> wrappers compiled on table set, which was missing before, leading to
> the referenced bug.
>
> R=ahaas@chromium.org
>
> Bug:  chromium:779292 
> Change-Id: Ib9132d9faeb1092c46e22dd8196d201ce5c0942f
> Reviewed-on: https://chromium-review.googlesource.com/774838
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49452}

Bug:  chromium:779292 
Change-Id: I8219305fc894c50904db57e51245733f6613dcd3
Reviewed-on: https://chromium-review.googlesource.com/778159
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49508}
[modify] https://crrev.com/3380e9a4d92a67881c4ff9d83e6d7d5b85a79750/src/compiler/wasm-compiler.cc
[modify] https://crrev.com/3380e9a4d92a67881c4ff9d83e6d7d5b85a79750/src/compiler/wasm-compiler.h
[modify] https://crrev.com/3380e9a4d92a67881c4ff9d83e6d7d5b85a79750/src/wasm/module-compiler.cc
[modify] https://crrev.com/3380e9a4d92a67881c4ff9d83e6d7d5b85a79750/src/wasm/wasm-objects.cc
[modify] https://crrev.com/3380e9a4d92a67881c4ff9d83e6d7d5b85a79750/test/mjsunit/wasm/interpreter.js

ClusterFuzz has detected this issue as fixed in range 49507:49508.

Detailed report: https://clusterfuzz.com/testcase?key=5189026335424512

Fuzzer: ochang_js_fuzzer
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  2 == deopt_data->length() in wasm-interpreter.cc
  v8::internal::wasm::ThreadImpl::CallCodeObject
  CallIndirectFunction
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=48580:48581
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=49507:49508

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5189026335424512

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5189026335424512 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.