(function (stdlib, n, heap) {
    "use asm";
    var Float64ArrayView = new stdlib.Float64Array(heap);
    function f(d1) {
      d1 = +d1;
      return d1;
      Float64ArrayView[~~.0 >> 3];
      return +8;
    }
    return f;
})();

AddressSanitizer:DEADLYSIGNAL
=================================================================
==25492==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000030 (pc 0x564cb13aaf06 bp 0x7ffd21935f70 sp 0x7ffd21935e20 T0)
==25492==The signal is caused by a READ memory access.
==25492==Hint: address points to the zero page.
    #0 0x564cb13aaf05 in EmitTruncate((anonymous namespace)::FunctionCompiler&, js::wasm::ValType, js::wasm::ValType, bool, bool) /home/skygentoo/trees/mozilla-central/js/src/jit/MIR.h
    #1 0x564cb136a601 in EmitBodyExprs((anonymous namespace)::FunctionCompiler&) /home/skygentoo/trees/mozilla-central/js/src/wasm/WasmIonCompile.cpp
    #2 0x564cb1368115 in js::wasm::IonCompileFunctions(js::wasm::ModuleEnvironment const&, js::LifoAlloc&, mozilla::Vector<js::wasm::FuncCompileInput, 8ul, js::SystemAllocPolicy> const&, js::wasm::CompiledCode*, mozilla::UniquePtr<char [], JS::FreePolicy>*) /home/skygentoo/trees/mozilla-central/js/src/wasm/WasmIonCompile.cpp:5424:12
    #3 0x564cb133f890 in ExecuteCompileTask(js::wasm::CompileTask*, mozilla::UniquePtr<char [], JS::FreePolicy>*) /home/skygentoo/trees/mozilla-central/js/src/wasm/WasmGenerator.cpp:757:16
    #4 0x564cb13419e4 in js::wasm::ModuleGenerator::locallyCompileCurrentTask() /home/skygentoo/trees/mozilla-central/js/src/wasm/WasmGenerator.cpp:817:8
    #5 0x564cb13419e4 in js::wasm::ModuleGenerator::finishFuncDefs() /home/skygentoo/trees/mozilla-central/js/src/wasm/WasmGenerator.cpp:955:24
    #6 0x564cb12f95f2 in ModuleValidator<mozilla::Utf8Unit>::finish() /home/skygentoo/trees/mozilla-central/js/src/wasm/AsmJS.cpp:2139:13
    #7 0x564cb1155118 in RefPtr<js::wasm::Module const> CheckModule<mozilla::Utf8Unit>(JSContext*, js::frontend::CompilationInfo&, js::frontend::Parser<js::frontend::FullParseHandler, mozilla::Utf8Unit>&, js::frontend::ParseNode*, unsigned int*) /home/skygentoo/trees/mozilla-central/js/src/wasm/AsmJS.cpp:6408:27
    #8 0x564cb1155118 in bool DoCompileAsmJS<mozilla::Utf8Unit>(JSContext*, js::frontend::CompilationInfo&, js::frontend::Parser<js::frontend::FullParseHandler, mozilla::Utf8Unit>&, js::frontend::ParseNode*, bool*) /home/skygentoo/trees/mozilla-central/js/src/wasm/AsmJS.cpp:7065:7
    #9 0x564cb1155118 in js::CompileAsmJS(JSContext*, js::frontend::CompilationInfo&, js::frontend::Parser<js::frontend::FullParseHandler, mozilla::Utf8Unit>&, js::frontend::ParseNode*, bool*) /home/skygentoo/trees/mozilla-central/js/src/wasm/AsmJS.cpp:7094:10
    #10 0x564cafef1d14 in js::frontend::Parser<js::frontend::FullParseHandler, mozilla::Utf8Unit>::asmJS(js::frontend::ListNode*) /home/skygentoo/trees/mozilla-central/js/src/frontend/Parser.cpp:3642:8
    #11 0x564cafef1d14 in js::frontend::GeneralParser<js::frontend::FullParseHandler, mozilla::Utf8Unit>::asmJS(js::frontend::ListNode*) /home/skygentoo/trees/mozilla-central/js/src/frontend/Parser.cpp:3655:27
/snip

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/09390cf1d667
user:        Dmitry Bezhetskov
date:        Mon Sep 14 05:19:44 2020 +0000
summary:     Bug 1639153 - Part 6.6: Add tls dependency for truncate i32. r=lth

Run with --fuzzing-safe --no-threads --no-baseline --no-ion, compile with AR=ar sh ./configure --enable-address-sanitizer --disable-jemalloc --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests, tested on m-c rev b21d31971a86.

Full log coming up.

Guessing related to bug 1639153?

Yeah... Dmitry, can you take a look?

Sure, let me see

I manage to reproduce it, thanks for the command Gary Kwong.
Will provide a fix soon.

I've uploaded the fast fix, but I thought that such construction guarantee that input is set:

if (!f.iter().readConversion(operandType, resultType, &input)) {
    return false;
}

Suddenly, input can be null for asm.js.

This is an NPE and sec-low/sec-other. The patch can land on Nightly, it's a Nightly-only regression.

Fast fix for null pointer dereference in EmitTruncate. r=lth
https://hg.mozilla.org/integration/autoland/rev/f999994ff31263695f15c5313b29c7e8b3b01441

https://hg.mozilla.org/mozilla-central/rev/f999994ff312

Backed out on request from lth for stability issues: https://hg.mozilla.org/mozilla-central/rev/41fa4179cc8c

Beta backout is https://hg.mozilla.org/releases/mozilla-beta/rev/a9d230c1649f

I think we can close this? Not 100% sure why it was reopened.

Fixed because regressor bug 1639153 got backed out.