ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://cluster-fuzz.appspot.com/testcase?key=5812391926562816

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://cluster-fuzz.appspot.com/testcase?key=5787321095159808

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://cluster-fuzz.appspot.com/testcase?key=5028970698637312

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://cluster-fuzz.appspot.com/testcase?key=5883837331800064

Clusterfuzz confirmed the crash (https://cluster-fuzz.appspot.com/v2/testcase-detail/5028970698637312).

Thank you, hadeswillj@ for reporting this!

hpayer@, I wonder if you can take a look. Thanks.

Assigning to the current memory sheriff.

Alright, it's related to crankshaft allocation folding. Without folding (--nouse-allocation-folding) it doesn't crash. Also, I see some folding going on immediately before the crash. Another symptom is that top is already behind limit when we enter the runtime.

output (likely useless without inspecting using C1 visualizer):
  #21 (Allocate) cannot fold into #14 (StackCheck)
  #800 (Allocate) inserted for dominator #21 (Allocate)
  #31 (Allocate) folded into #21 (Allocate), new dominator size: 1080
  #21 (Allocate) cannot fold into #14 (StackCheck)

The symptom is that top overtakes limit, which a simple print confirms:
  EnsureAllocation: size: 552, old_top: 0xeff801e0 old_limit: 0xeff80000, high: 0xeff80000
                                        ^^^^^^^^^^            ^^^^^^^^^^

gn args:
is_component_build = true
is_debug = true
use_goma = true
is_asan = true
target_cpu = "x86"
v8_enable_backtrace = true
v8_enable_slow_dchecks = true
v8_target_cpu = "arm"

The old folding implementation (tried 2fe1ee4e0484119243ff32ecbb203335cb64045b) also crashes.

+out log

Deleted: folding.log 283 KB

folding.log 283 KB View Download

Seems to be the same issue Jakob is currently debugging/fixing. We allocate on the very end of page and access out of bounds above limit, which is a different (often unmapped) page.

Tested a fix locally and I am not able to reproduce the problem anymore.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot