Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/f2e19a63873a700e6c0a1bca35e8301bd50db4e1 ([wasm] Add --wasm-jit-to-native under --future).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

Downgrading this to Medium severity since it's behind the --future flag currently.

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/958b78a795e8f78ab6fff0074a56432d179ba948

commit 958b78a795e8f78ab6fff0074a56432d179ba948
Author: Mircea Trofin <mtrofin@chromium.org>
Date: Fri Dec 15 17:00:16 2017

[wasm] Ensure indirect calls happen in the context of the owning instance

Bug:  chromium:793714 
Change-Id: I8c1ea8a2e27b5a7fe9cd1f8260873057a3bf9fd9
Reviewed-on: https://chromium-review.googlesource.com/826030
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50136}
[modify] https://crrev.com/958b78a795e8f78ab6fff0074a56432d179ba948/src/wasm/module-compiler.cc
[modify] https://crrev.com/958b78a795e8f78ab6fff0074a56432d179ba948/src/wasm/wasm-module.cc
[modify] https://crrev.com/958b78a795e8f78ab6fff0074a56432d179ba948/src/wasm/wasm-module.h
[modify] https://crrev.com/958b78a795e8f78ab6fff0074a56432d179ba948/src/wasm/wasm-objects.cc
[modify] https://crrev.com/958b78a795e8f78ab6fff0074a56432d179ba948/test/mjsunit/wasm/indirect-tables.js

ClusterFuzz has detected this issue as fixed in range 50135:50136.

Detailed report: https://clusterfuzz.com/testcase?key=5569121000620032

Fuzzer: ochang_js_fuzzer
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  *code->owner()->compiled_module()->owning_instance() == codemap()->instance() in
  v8::internal::wasm::ThreadImpl::CallWasmCode
  CallIndirectFunction
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=49947:49948
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=50135:50136

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5569121000620032

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5569121000620032 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This wasn't actually blocking v8:6876, it was a pre-existing issue that wasm off the heap inherited and then surfaced. 

We need to backport this fix (the wasm _on_ the GC heap part).

This bug requires manual review: M64 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), kbleicher@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

+Brad for the merge

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/58cedca8eab0051040fa8a2051be04b46ce28ee9

commit 58cedca8eab0051040fa8a2051be04b46ce28ee9
Author: Brad Nelson <bradnelson@chromium.org>
Date: Wed Jan 17 01:49:20 2018

[wasm] Ensure indirect calls happen in the context of the owning instance

TBR=mtrofin@chromium.org

(cherry picked from commit 958b78a795e8f78ab6fff0074a56432d179ba948)

Bug:  chromium:793714 
Change-Id: I8c1ea8a2e27b5a7fe9cd1f8260873057a3bf9fd9
Reviewed-on: https://chromium-review.googlesource.com/826030
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#50136}
Reviewed-on: https://chromium-review.googlesource.com/869350
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.4@{#61}
Cr-Branched-From: 0407506af3d9d7e2718be1d8759296165b218fcf-refs/heads/6.4.388@{#1}
Cr-Branched-From: a5fc4e085ee543cb608eb11034bc8f147ba388e1-refs/heads/master@{#49724}
[modify] https://crrev.com/58cedca8eab0051040fa8a2051be04b46ce28ee9/src/wasm/module-compiler.cc
[modify] https://crrev.com/58cedca8eab0051040fa8a2051be04b46ce28ee9/src/wasm/wasm-module.cc
[modify] https://crrev.com/58cedca8eab0051040fa8a2051be04b46ce28ee9/src/wasm/wasm-module.h
[modify] https://crrev.com/58cedca8eab0051040fa8a2051be04b46ce28ee9/src/wasm/wasm-objects.cc
[modify] https://crrev.com/58cedca8eab0051040fa8a2051be04b46ce28ee9/test/mjsunit/wasm/indirect-tables.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/22cb120a199c3d25030cd4fe249ee5eef6a70565

commit 22cb120a199c3d25030cd4fe249ee5eef6a70565
Author: Clemens Hammacher <clemensh@chromium.org>
Date: Wed Jan 17 10:00:21 2018

[wasm] Fix compile error

The compile error was introduced in an earilier backmerge:
https://crrev.com/c/869350

R=titzer@chromium.org
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Bug:  chromium:793714 
Change-Id: Ib67839f85cab1bb8f2c83b9c1af8c460c90cd3c9
Reviewed-on: https://chromium-review.googlesource.com/870250
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.4@{#67}
Cr-Branched-From: 0407506af3d9d7e2718be1d8759296165b218fcf-refs/heads/6.4.388@{#1}
Cr-Branched-From: a5fc4e085ee543cb608eb11034bc8f147ba388e1-refs/heads/master@{#49724}
[modify] https://crrev.com/22cb120a199c3d25030cd4fe249ee5eef6a70565/src/wasm/wasm-module.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/3349a632596d0adfc880044286031a3317ee8c9c

commit 3349a632596d0adfc880044286031a3317ee8c9c
Author: Clemens Hammacher <clemensh@chromium.org>
Date: Wed Jan 17 11:00:03 2018

Revert "[wasm] Fix compile error"

This reverts commit 22cb120a199c3d25030cd4fe249ee5eef6a70565.

Reason for revert: Still failing tests.

Original change's description:
> [wasm] Fix compile error
> 
> The compile error was introduced in an earilier backmerge:
> https://crrev.com/c/869350
> 
> R=​titzer@chromium.org
> NOTRY=true
> NOPRESUBMIT=true
> NOTREECHECKS=true
> 
> Bug:  chromium:793714 
> Change-Id: Ib67839f85cab1bb8f2c83b9c1af8c460c90cd3c9
> Reviewed-on: https://chromium-review.googlesource.com/870250
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Cr-Commit-Position: refs/branch-heads/6.4@{#67}
> Cr-Branched-From: 0407506af3d9d7e2718be1d8759296165b218fcf-refs/heads/6.4.388@{#1}
> Cr-Branched-From: a5fc4e085ee543cb608eb11034bc8f147ba388e1-refs/heads/master@{#49724}

TBR=titzer@chromium.org,clemensh@chromium.org

Change-Id: I7c3f78d26b0a1ba5fbea69ba24b38499bc79e07b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  chromium:793714 
Reviewed-on: https://chromium-review.googlesource.com/869671
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.4@{#69}
Cr-Branched-From: 0407506af3d9d7e2718be1d8759296165b218fcf-refs/heads/6.4.388@{#1}
Cr-Branched-From: a5fc4e085ee543cb608eb11034bc8f147ba388e1-refs/heads/master@{#49724}
[modify] https://crrev.com/3349a632596d0adfc880044286031a3317ee8c9c/src/wasm/wasm-module.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/4fd56e705f75cff6089760c8b6bb3b15ce637f2a

commit 4fd56e705f75cff6089760c8b6bb3b15ce637f2a
Author: Clemens Hammacher <clemensh@chromium.org>
Date: Wed Jan 17 11:01:07 2018

Revert "[wasm] Ensure indirect calls happen in the context of the owning instance"

This reverts commit 58cedca8eab0051040fa8a2051be04b46ce28ee9.

Reason for revert: Tests failing.

Original change's description:
> [wasm] Ensure indirect calls happen in the context of the owning instance
> 
> TBR=mtrofin@chromium.org
> 
> (cherry picked from commit 958b78a795e8f78ab6fff0074a56432d179ba948)
> 
> Bug:  chromium:793714 
> Change-Id: I8c1ea8a2e27b5a7fe9cd1f8260873057a3bf9fd9
> Reviewed-on: https://chromium-review.googlesource.com/826030
> Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Cr-Original-Commit-Position: refs/heads/master@{#50136}
> Reviewed-on: https://chromium-review.googlesource.com/869350
> Reviewed-by: Brad Nelson <bradnelson@chromium.org>
> Cr-Commit-Position: refs/branch-heads/6.4@{#61}
> Cr-Branched-From: 0407506af3d9d7e2718be1d8759296165b218fcf-refs/heads/6.4.388@{#1}
> Cr-Branched-From: a5fc4e085ee543cb608eb11034bc8f147ba388e1-refs/heads/master@{#49724}

TBR=bradnelson@chromium.org,mtrofin@chromium.org,ahaas@chromium.org,clemensh@chromium.org

Change-Id: I7d62c004e6f450eb5d872e4441741060f1eecdb2
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  chromium:793714 
Reviewed-on: https://chromium-review.googlesource.com/870037
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.4@{#70}
Cr-Branched-From: 0407506af3d9d7e2718be1d8759296165b218fcf-refs/heads/6.4.388@{#1}
Cr-Branched-From: a5fc4e085ee543cb608eb11034bc8f147ba388e1-refs/heads/master@{#49724}
[modify] https://crrev.com/4fd56e705f75cff6089760c8b6bb3b15ce637f2a/src/wasm/module-compiler.cc
[modify] https://crrev.com/4fd56e705f75cff6089760c8b6bb3b15ce637f2a/src/wasm/wasm-module.cc
[modify] https://crrev.com/4fd56e705f75cff6089760c8b6bb3b15ce637f2a/src/wasm/wasm-module.h
[modify] https://crrev.com/4fd56e705f75cff6089760c8b6bb3b15ce637f2a/src/wasm/wasm-objects.cc
[modify] https://crrev.com/4fd56e705f75cff6089760c8b6bb3b15ce637f2a/test/mjsunit/wasm/indirect-tables.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/9e018ecdebf494215428264e36866da09e7dba95

commit 9e018ecdebf494215428264e36866da09e7dba95
Author: Clemens Hammacher <clemensh@chromium.org>
Date: Wed Jan 17 12:55:16 2018

Reland "[wasm] Ensure indirect calls happen in the context of the owning instance"

This is a reland of 58cedca8eab0051040fa8a2051be04b46ce28ee9, with compilation
error and test failures fixed.

Original change's description:
> [wasm] Ensure indirect calls happen in the context of the owning instance
>
> TBR=mtrofin@chromium.org
>
> (cherry picked from commit 958b78a795e8f78ab6fff0074a56432d179ba948)
>
> Bug:  chromium:793714 
> Change-Id: I8c1ea8a2e27b5a7fe9cd1f8260873057a3bf9fd9
> Reviewed-on: https://chromium-review.googlesource.com/826030
> Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Cr-Original-Commit-Position: refs/heads/master@{#50136}
> Reviewed-on: https://chromium-review.googlesource.com/869350
> Reviewed-by: Brad Nelson <bradnelson@chromium.org>
> Cr-Commit-Position: refs/branch-heads/6.4@{#61}
> Cr-Branched-From: 0407506af3d9d7e2718be1d8759296165b218fcf-refs/heads/6.4.388@{#1}
> Cr-Branched-From: a5fc4e085ee543cb608eb11034bc8f147ba388e1-refs/heads/master@{#49724}

Bug:  chromium:793714 
Change-Id: I46b1c514c445d5bc3947b5207c86352942e70313
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/870038
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.4@{#72}
Cr-Branched-From: 0407506af3d9d7e2718be1d8759296165b218fcf-refs/heads/6.4.388@{#1}
Cr-Branched-From: a5fc4e085ee543cb608eb11034bc8f147ba388e1-refs/heads/master@{#49724}
[modify] https://crrev.com/9e018ecdebf494215428264e36866da09e7dba95/src/wasm/module-compiler.cc
[modify] https://crrev.com/9e018ecdebf494215428264e36866da09e7dba95/src/wasm/wasm-module.cc
[modify] https://crrev.com/9e018ecdebf494215428264e36866da09e7dba95/src/wasm/wasm-module.h
[modify] https://crrev.com/9e018ecdebf494215428264e36866da09e7dba95/src/wasm/wasm-objects.cc
[modify] https://crrev.com/9e018ecdebf494215428264e36866da09e7dba95/test/mjsunit/wasm/indirect-tables.js

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot