fix: detect WASM IPInt crash by segfault address pattern

The auto-close script for known WASM IPInt crashes (#17841) only matched
the decoded symbol `wasm_trampoline_wasm_ipint_call_wide32`. Issue #27291
only contained the raw crash address (0x7FA746505845) without decoded
stack traces, so the pattern missed it.

Add address-based detection for the ASLR-invariant low 32 bits
(0x46505845) that uniquely identify this JSC WASM IPInt crash.

Closes #27291

Co-Authored-By: Claude <noreply@anthropic.com>

scripts/handle-crash-patterns.ts

@@ -57,8 +57,14 @@ bun upgrade
   };
 }
 
-// Check for WASM IPInt 32 stack traces - be very specific to avoid false positives
-else if (bodyLower.includes("wasm_trampoline_wasm_ipint_call_wide32")) {
+// Check for WASM IPInt 32 stack traces - be very specific to avoid false positives.
+// Also match by the characteristic segfault address suffix 0x46505845, which is the
+// ASLR-invariant low 32 bits unique to this crash (high bytes vary per ASLR randomization).
+// This catches reports that only include the raw crash address without decoded stack traces.
+else if (
+  bodyLower.includes("wasm_trampoline_wasm_ipint_call_wide32") ||
+  (bodyLower.includes("segmentation fault") && /segmentation fault at address 0x[0-9a-f]*46505845\b/i.test(body))
+) {
   closeAction = {
     reason: "not_planned",
     comment: `Duplicate of #17841.

test/regression/issue/27291.test.ts

@@ -0,0 +1,54 @@
+import { describe, expect, test } from "bun:test";
+import { bunEnv, bunExe } from "harness";
+
+describe("handle-crash-patterns WASM IPInt detection", () => {
+  const scriptPath = new URL("../../../scripts/handle-crash-patterns.ts", import.meta.url).pathname;
+
+  function runPattern(body: string): { close: boolean; reason?: string; comment?: string } {
+    const result = Bun.spawnSync({
+      cmd: [bunExe(), scriptPath],
+      env: {
+        ...bunEnv,
+        GITHUB_ISSUE_NUMBER: "1",
+        GITHUB_ISSUE_TITLE: "test",
+        GITHUB_ISSUE_BODY: body,
+      },
+    });
+    return JSON.parse(result.stdout.toString());
+  }
+
+  test("detects wasm_trampoline_wasm_ipint_call_wide32 in decoded stack trace", () => {
+    const result = runPattern("Segmentation fault at address 0x7F7146505845\n- wasm_trampoline_wasm_ipint_call_wide32");
+    expect(result.close).toBe(true);
+    expect(result.reason).toBe("not_planned");
+    expect(result.comment).toContain("#17841");
+  });
+
+  test("detects WASM IPInt crash by address suffix 0x46505845 from issue #27291", () => {
+    // This is the actual body pattern from issue #27291, which only had
+    // the raw crash address without the decoded stack trace symbols.
+    const result = runPattern(
+      "panic(main thread): Segmentation fault at address 0x7FA746505845\n\nElapsed: 50255203ms",
+    );
+    expect(result.close).toBe(true);
+    expect(result.reason).toBe("not_planned");
+    expect(result.comment).toContain("#17841");
+  });
+
+  test("detects WASM IPInt crash by address suffix from issue #17841", () => {
+    const result = runPattern("Segmentation fault at address 0x7F7146505845");
+    expect(result.close).toBe(true);
+    expect(result.reason).toBe("not_planned");
+    expect(result.comment).toContain("#17841");
+  });
+
+  test("does not false-positive on different segfault addresses", () => {
+    expect(runPattern("Segmentation fault at address 0x7FA746505846").close).toBe(false);
+    expect(runPattern("Segmentation fault at address 0x12345678").close).toBe(false);
+    expect(runPattern("Segmentation fault at address 0xDEADBEEF").close).toBe(false);
+  });
+
+  test("does not false-positive on segmentation fault without address", () => {
+    expect(runPattern("Segmentation fault happened").close).toBe(false);
+  });
+});