Unexpected operator #157:StoreField @ node #328 in instruction-selector.cc |
||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5892728452022272 Fuzzer: mbarbella_js_mutation Job Type: windows_asan_d8 Platform Id: windows Crash Type: CHECK failure Crash Address: Crash State: Unexpected operator #157:StoreField @ node #328 in instruction-selector.cc Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_d8&range=408734:408781 Minimized Testcase (0.23 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv96v2dMC3Bg52LDcut1bdX9H17DqEjBYyr_R-Z6UKK4A_zTf-EP-xyhsIh5Fsmyuhuai66b2hcLH4O4U6iwWPe5ssVt4tmyZFc-tqWunoPptuRooET6JTTXif8zPkUVJoIPteIpQtA1fEmlr46p49wWfbwMTuQ?testcase_id=5892728452022272 function __f_2() { for (var __v_2 = 0; __v_2 < 10000; __v_2++) { try { for (var __v_3 = 0; __v_3 < 2; __v_3++) { } throw 1; } catch(e) { if (typeof a == "number") return a && isNaN(b); } } } __f_2(); Issue manually filed by: mummareddy See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Aug 4 2016
The repro doesn't involve asm.js or WASM, so it shouldn't be generating UnalignedLoad. Looks like some node didn't get lowered or trimmed from the graph. Reassigning to bmeurer@.
,
Aug 4 2016
Thank you very much.
,
Aug 16 2016
Michael, can you investigate while I'm OOO?
,
Aug 17 2016
Sure thing...
,
Aug 17 2016
Hmm, tough to reproduce. The v8 version is 5.4.299, from Friday, July 29th. I get an assert in compile.cc about bytecode at that point with the repro flags --ignition --turbo-from-bytecode --always-opt And current builds don't repro. # # Fatal error in ../src/compiler.cc, line 1364 # Check failed: !info->shared_info()->is_compiled(). # ==== C stack trace =============================== 1: V8_Fatal 2: 0x913f82 3: 0x91173f 4: v8::internal::Compiler::GetOptimizedCodeForOSR(v8::internal::Handle<v8::internal::JSFunction>, v8::internal::BailoutId, v8::internal::JavaScriptFrame*) 5: 0xfc9560 6: v8::internal::Runtime_CompileForOnStackReplacement(int, v8::internal::Object**, v8::internal::Isolate*) 7: 0xf743e0063a7 Illegal instruction (core dumped)
,
Aug 22 2016
Unable to repro, and the bug in compiler.cc that I hit when trying to reproduce on an old tree was indicative of big changes happening in the pipeline at that point (in order to support the bifurcated pipeline of Ignition->TF and Ignition->FCG->Crankshaft).
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by mummare...@chromium.org
, Aug 4 2016Labels: M-54 Te-Logged
Owner: titzer@chromium.org
Status: Assigned (was: Untriaged)