A local, non-instrumented SyzyASAN build behaves the same way, so this is apparently not an instrumentation problem. Has to be Albatross, somehow.

Build 63.0.3239.1 behaves the same way.

Hmm, so this is a 32 bit build anomaly. I installed Version 63.0.3239.0 (Official Build) canary (32-bit), and the problem repros there too. The 64 bit version is fine.

Assigning to Prudhvi for bisecting, as this isn't a SyzyASAN problem - this seems to affect 32 bit builds of Chrome on Windows at least.

-syzygy-team as this is not a Syzygy problem

Please find the bisect range :

You are probably looking for a change made after 507351 (known good), but no later than 507358 (first known bad).
CHANGELOG URL:
  https://chromium.googlesource.com/chromium/src/+log/d333bed7476464825f8dbbb2ab5dcd01d690de15..4c48b5daa096160b7ef0a3cd6674d082fa3e9d2d

suspected CL(Very unknowledgeable guess) : https://chromium.googlesource.com/v8/v8/+/1aa09302a08bb01e486e4c274abc39769bb61076


Note : Some reason I wasn't able to perform the per-cl bisect for Chrome 32 due to some script issues will check that in a bit.

Running the browser with --js-flags="--noopt" allows Inbox to load as usual, though maybe even slower than usual. I'm rebuilding with V8 backed up to before the suspected CL to confirm, but this'll take an hour or two.

Jakob has kindly offered to try and revert the offending CL today.

Please revert the CL ASAP, we are branching M63 today.

Please request a merge to M63 once revert is landed/baked in Canary.

Yups, if I back V8 up to before https://chromium.googlesource.com/v8/v8/+/1aa09302a08bb01e486e4c274abc39769bb61076, Inbox loads just fine in a 32 bit build.

And if I patch https://chromium.googlesource.com/v8/v8/+/1aa09302a08bb01e486e4c274abc39769bb61076 back into my working release build, it's horked again. It's the one(TM).

Stopgap fix in flight: https://chromium-review.googlesource.com/c/v8/v8/+/719461

(Reverting is very difficult due to follow-up changes.)

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/a3de183f705dc4c4e4a13c03910db5a4d84f1a22

commit a3de183f705dc4c4e4a13c03910db5a4d84f1a22
Author: Jakob Kummerow <jkummerow@chromium.org>
Date: Fri Oct 13 19:30:03 2017

[turbofan] Turn off lowering to kFindOrderedHashMapEntryForInt32Key.

As a simple and backmergeable fix for  crbug.com/774459 .

Bug:  chromium:774459 
Tbr: bmeurer@chromium.org
Change-Id: Ibe55ad13fe6be63a76dc3079a0288356ce35de9f
Reviewed-on: https://chromium-review.googlesource.com/719461
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48561}
[modify] https://crrev.com/a3de183f705dc4c4e4a13c03910db5a4d84f1a22/src/compiler/simplified-lowering.cc

Closing this, as the user-visible problem is mitigated.

I assume Benedikt has solving the actual underlying bug on his radar ;-)

The patch is conservative enough that we could back-merge immediately, but we can also wait for Canary coverage.

Pls request a merge to M63 after if change looks good in canary.

Inbox is loading again for me in "Version 64.0.3242.0 (Official Build) canary (32-bit)"

Also loads in Version 64.0.3242.1 (Official Build) canary SyzyASan (32-bit), even with chrome://flags/#dcheck-is-fatal Enabled.

Approving merge to M63 branch 3239 based on comment #22 & #23. 

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/e415875d1a485ba06f467d28bbb0c11ec3d250b5

commit e415875d1a485ba06f467d28bbb0c11ec3d250b5
Author: Jakob Kummerow <jkummerow@chromium.org>
Date: Tue Oct 17 20:15:04 2017

Merged: [turbofan] Turn off lowering to kFindOrderedHashMapEntryForInt32Key.

Revision: a3de183f705dc4c4e4a13c03910db5a4d84f1a22

BUG= chromium:774459 
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=cbruni@chromium.org

Change-Id: Ia785eaaa6effe18f31ec59fdb9544ffc36b5195f
Reviewed-on: https://chromium-review.googlesource.com/723593
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.3@{#20}
Cr-Branched-From: 094a7c93dcdcd921de3883ba4674b7e1a0feffbe-refs/heads/6.3.292@{#1}
Cr-Branched-From: 18b8fbb528a8021e04a029e06eafee50b918bce0-refs/heads/master@{#48432}
[modify] https://crrev.com/e415875d1a485ba06f467d28bbb0c11ec3d250b5/src/compiler/simplified-lowering.cc

All done here.