Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/f2e19a63873a700e6c0a1bca35e8301bd50db4e1 ([wasm] Add --wasm-jit-to-native under --future).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.

Only reproduces with --wasm-lazy-compilation, which is not on by default, hence lowering priority.

Setting to Security_Impact-none since this is not on by default. If there's a set of users who typically set this flag, we should probably change it back to Impact-head.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/f30a86c8d355c70f1fe0a098ad0592b188dc5acf

commit f30a86c8d355c70f1fe0a098ad0592b188dc5acf
Author: Michael Starzinger <mstarzinger@chromium.org>
Date: Mon Jan 22 13:11:11 2018

[wasm] Fix lazy compilation with native-heap code.

This fixes a corner-case with lazy compilation in WebAssembly where
native-heap code did not expect to see WASM-to-JS wrappers in tables.

R=clemensh@chromium.org
TEST=mjsunit/regress/wasm/regress-803788
BUG= chromium:803788 

Change-Id: Ie44b5c9efe2b171e1915295bb95d6cb61dfab3dc
Reviewed-on: https://chromium-review.googlesource.com/878262
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50755}
[modify] https://crrev.com/f30a86c8d355c70f1fe0a098ad0592b188dc5acf/src/wasm/module-compiler.cc
[add] https://crrev.com/f30a86c8d355c70f1fe0a098ad0592b188dc5acf/test/mjsunit/regress/wasm/regress-803788.js

ClusterFuzz has detected this issue as fixed in range 50754:50755.

Detailed report: https://clusterfuzz.com/testcase?key=6221609999532032

Fuzzer: ochang_js_fuzzer
Job Type: linux_d8_dbg
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  wasm::WasmCode::kLazyStub == code->kind() in module-compiler.cc
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_d8_dbg&range=49947:49948
Fixed: https://clusterfuzz.com/revisions?job=linux_d8_dbg&range=50754:50755

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6221609999532032

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6221609999532032 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot