Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/1cee0e012eb3731f177af8196b6ddb9256df542d (Reland^4 "[turbofan] eagerly prune None types and deadness from the graph").

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/2bf0199518c93b409c5a770f3308e20c4a3acbc0

commit 2bf0199518c93b409c5a770f3308e20c4a3acbc0
Author: Tobias Tebbi <tebbi@chromium.org>
Date: Thu Oct 19 13:48:38 2017

Revert "Reland^4 "[turbofan] eagerly prune None types and deadness from the graph""

This revert is manual, but almost completely automatic. 
It was just blocked by a single-line irrelevant refactoring change.
This reverts commit 1cee0e012eb3731f177af8196b6ddb9256df542d.

Reason for revert: chromium:776256

Original change's description:
> Reland^4 "[turbofan] eagerly prune None types and deadness from the graph"
>
> This fixes https://bugs.chromium.org/p/chromium/issues/detail?id=773954.
> The issue was that in the EffectControlLinearizer, the effect input of an
> {Unreachable} node was not updated, leaving a {Checkpoint} behind.
>
> This is a reland of 4cf476458ffc5dad0241335fbcef1d21b7ae6cb7
> Original change's description:
> > Reland^3 "[turbofan] eagerly prune None types and deadness from the graph"
> >
> > This fixes the issues
> > https://bugs.chromium.org/p/chromium/issues/detail?id=772873
> > and https://bugs.chromium.org/p/chromium/issues/detail?id=772872.
> >
> > One problem was that mutating an effect node into Unreachable confused
> > the LoadElimination sidetables, so I just always create a new node now.
> >
> > The other problem was that UpdateBlockControl() was executed after
> > UpdateEffectPhi() in the lazy case. This reverted the update to the Merge input.
> > So now I make sure that UpdateEffectPhi() is always executed last.
> >
> > This is a reland of 6ddb5e7da75c96405911029f614b348da209cee7
> > Original change's description:
> > > Reland^2 "[turbofan] eagerly prune None types and deadness from the graph"
> > >
> > > Now, the EffectControlLinearizer connects all occurrences of Unreachable to the
> > > graph end. This fixes issues with later phases running DeadCodeElimination and
> > > introducing new DeadValue nodes when processing uses of Unreachable.
> > >
> > > This is a reland of 3c4bc27f132b6221836e702684cdb4a3e0d009c0
> > > Original change's description:
> > > > Reland "[turbofan] eagerly prune None types and deadness from the graph"
> > > >
> > > > This is a reland of e1cdda2512d9844e180883902b08ed9b302471c0
> > > > Original change's description:
> > > > > [turbofan] eagerly prune None types and deadness from the graph
> > > > >
> > > > > In addition to using the {Dead} node to prune dead control nodes and nodes that
> > > > > depend on them, we introduce a {DeadValue} node representing an impossible value
> > > > > that can occur at any position in the graph. The extended {DeadCodeElimination}
> > > > > prunes {DeadValue} and its uses, inserting a crashing {Unreachable} node into
> > > > > the effect chain when possible. The remaining uses of {DeadValue} are handled
> > > > > in {EffectControlLinearizer}, where we always have access to the effect chain.
> > > > > In addition to explicitly introduced {DeadValue} nodes, we consider any value use
> > > > > of a node with type {None} as dead.
> > > > >
> > > > > Bug: chromium:741225
> > > > > Change-Id: Icc4b636d1d018c452ba1a2fa7cd3e00e522f1655
> > > > > Reviewed-on: https://chromium-review.googlesource.com/641250
> > > > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > > > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> > > > > Cr-Commit-Position: refs/heads/master@{#48208}
> > > >
> > > > Bug: chromium:741225
> > > > Change-Id: I21316913dae02864f7a6d7c9269405a79f054138
> > > > Reviewed-on: https://chromium-review.googlesource.com/692034
> > > > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> > > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > > Cr-Commit-Position: refs/heads/master@{#48232}
> > >
> > > Bug: chromium:741225
> > > Change-Id: I5702ec34856c075717162153adc765774453c45f
> > > Reviewed-on: https://chromium-review.googlesource.com/702264
> > > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#48366}
> >
> > Bug: chromium:741225
> > Change-Id: I4054a694d2521c2e1f0c4a3ad0f3cf100b5c536f
> > Reviewed-on: https://chromium-review.googlesource.com/709214
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#48469}
>
> Bug: chromium:741225
> Change-Id: Id9d4f3a3ae36cb3e38f80edcdba88efa7922ca24
> Reviewed-on: https://chromium-review.googlesource.com/715716
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48660}

TBR=jarin@chromium.org,tebbi@chromium.org,bmeurer@chromium.org


Bug: chromium:741225  chromium:776256 
Change-Id: Iaf2af3cb6dea5fdece43297cb9d987e7decc726d
Reviewed-on: https://chromium-review.googlesource.com/727804
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48749}
[modify] https://crrev.com/2bf0199518c93b409c5a770f3308e20c4a3acbc0/src/compiler/branch-elimination.cc
[modify] https://crrev.com/2bf0199518c93b409c5a770f3308e20c4a3acbc0/src/compiler/common-operator.cc
[modify] https://crrev.com/2bf0199518c93b409c5a770f3308e20c4a3acbc0/src/compiler/common-operator.h
[modify] https://crrev.com/2bf0199518c93b409c5a770f3308e20c4a3acbc0/src/compiler/dead-code-elimination.cc
[modify] https://crrev.com/2bf0199518c93b409c5a770f3308e20c4a3acbc0/src/compiler/dead-code-elimination.h
[modify] https://crrev.com/2bf0199518c93b409c5a770f3308e20c4a3acbc0/src/compiler/effect-control-linearizer.cc
[modify] https://crrev.com/2bf0199518c93b409c5a770f3308e20c4a3acbc0/src/compiler/instruction-selector.cc
[modify] https://crrev.com/2bf0199518c93b409c5a770f3308e20c4a3acbc0/src/compiler/instruction-selector.h
[modify] https://crrev.com/2bf0199518c93b409c5a770f3308e20c4a3acbc0/src/compiler/js-graph.cc
[modify] https://crrev.com/2bf0199518c93b409c5a770f3308e20c4a3acbc0/src/compiler/js-graph.h
[modify] https://crrev.com/2bf0199518c93b409c5a770f3308e20c4a3acbc0/src/compiler/memory-optimizer.cc
[modify] https://crrev.com/2bf0199518c93b409c5a770f3308e20c4a3acbc0/src/compiler/opcodes.h
[modify] https://crrev.com/2bf0199518c93b409c5a770f3308e20c4a3acbc0/src/compiler/pipeline.cc
[modify] https://crrev.com/2bf0199518c93b409c5a770f3308e20c4a3acbc0/src/compiler/representation-change.cc
[modify] https://crrev.com/2bf0199518c93b409c5a770f3308e20c4a3acbc0/src/compiler/simplified-lowering.cc
[modify] https://crrev.com/2bf0199518c93b409c5a770f3308e20c4a3acbc0/src/compiler/typer.cc
[modify] https://crrev.com/2bf0199518c93b409c5a770f3308e20c4a3acbc0/src/compiler/verifier.cc
[delete] https://crrev.com/84c9f05d5b3ac512bc21f1d5e9a99e5b764d6c9e/test/mjsunit/compiler/regress-772872.js
[delete] https://crrev.com/84c9f05d5b3ac512bc21f1d5e9a99e5b764d6c9e/test/mjsunit/compiler/regress-773954.js

ClusterFuzz has detected this issue as fixed in range 48748:48749.

Detailed report: https://clusterfuzz.com/testcase?key=6381963501109248

Fuzzer: ochang_js_fuzzer
Job Type: linux_asan_d8_dbg
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  input->op()->ValueOutputCount() > index in verifier.cc
  v8::internal::compiler::Verifier::Visitor::Check
  v8::internal::compiler::Verifier::Run
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=48659:48660
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=48748:48749

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6381963501109248

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 6381963501109248 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/ac0661b358bce7f9af6f23c3e640121f6ca20170

commit ac0661b358bce7f9af6f23c3e640121f6ca20170
Author: Tobias Tebbi <tebbi@chromium.org>
Date: Tue Nov 07 13:16:20 2017

Reland^5 "[turbofan] eagerly prune None types and deadness from the graph"

This gives up on earlier attempts to interpret DeadValue as a signal of 
unreachable code. This does not work because free-floating dead value 
nodes, and even pure branch nodes that use them, can get scheduled so
early that they get reachable. Instead, we now eagerly remove branches
that use DeadValue in DeadCodeElimination and replace DeadValue inputs 
to value phi nodes with dummy values.

Reland of https://chromium-review.googlesource.com/715716

Bug: chromium:741225  chromium:776256 
Change-Id: I251efd507c967d4a8882ad8fd2fd96c4185781fe
Reviewed-on: https://chromium-review.googlesource.com/727893
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49188}
[modify] https://crrev.com/ac0661b358bce7f9af6f23c3e640121f6ca20170/src/compiler/branch-elimination.cc
[modify] https://crrev.com/ac0661b358bce7f9af6f23c3e640121f6ca20170/src/compiler/common-operator.cc
[modify] https://crrev.com/ac0661b358bce7f9af6f23c3e640121f6ca20170/src/compiler/common-operator.h
[modify] https://crrev.com/ac0661b358bce7f9af6f23c3e640121f6ca20170/src/compiler/dead-code-elimination.cc
[modify] https://crrev.com/ac0661b358bce7f9af6f23c3e640121f6ca20170/src/compiler/dead-code-elimination.h
[modify] https://crrev.com/ac0661b358bce7f9af6f23c3e640121f6ca20170/src/compiler/effect-control-linearizer.cc
[modify] https://crrev.com/ac0661b358bce7f9af6f23c3e640121f6ca20170/src/compiler/instruction-selector.cc
[modify] https://crrev.com/ac0661b358bce7f9af6f23c3e640121f6ca20170/src/compiler/instruction-selector.h
[modify] https://crrev.com/ac0661b358bce7f9af6f23c3e640121f6ca20170/src/compiler/js-graph.cc
[modify] https://crrev.com/ac0661b358bce7f9af6f23c3e640121f6ca20170/src/compiler/js-graph.h
[modify] https://crrev.com/ac0661b358bce7f9af6f23c3e640121f6ca20170/src/compiler/memory-optimizer.cc
[modify] https://crrev.com/ac0661b358bce7f9af6f23c3e640121f6ca20170/src/compiler/opcodes.h
[modify] https://crrev.com/ac0661b358bce7f9af6f23c3e640121f6ca20170/src/compiler/pipeline.cc
[modify] https://crrev.com/ac0661b358bce7f9af6f23c3e640121f6ca20170/src/compiler/representation-change.cc
[modify] https://crrev.com/ac0661b358bce7f9af6f23c3e640121f6ca20170/src/compiler/simplified-lowering.cc
[modify] https://crrev.com/ac0661b358bce7f9af6f23c3e640121f6ca20170/src/compiler/typer.cc
[modify] https://crrev.com/ac0661b358bce7f9af6f23c3e640121f6ca20170/src/compiler/verifier.cc
[add] https://crrev.com/ac0661b358bce7f9af6f23c3e640121f6ca20170/test/mjsunit/compiler/regress-772872.js
[add] https://crrev.com/ac0661b358bce7f9af6f23c3e640121f6ca20170/test/mjsunit/compiler/regress-773954.js
[modify] https://crrev.com/ac0661b358bce7f9af6f23c3e640121f6ca20170/test/unittests/compiler/dead-code-elimination-unittest.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/c899637debff1e05ac40a1e0d50b0da588df645b

commit c899637debff1e05ac40a1e0d50b0da588df645b
Author: Tobias Tebbi <tebbi@chromium.org>
Date: Thu Nov 09 11:00:45 2017

Revert "Reland^5 "[turbofan] eagerly prune None types and deadness from the graph""

This reverts commit ac0661b358bce7f9af6f23c3e640121f6ca20170.

Reason for revert: Clusterfuzz unhappy: chromium:783019 chromium:783035

Original change's description:
> Reland^5 "[turbofan] eagerly prune None types and deadness from the graph"
>
> This gives up on earlier attempts to interpret DeadValue as a signal of
> unreachable code. This does not work because free-floating dead value
> nodes, and even pure branch nodes that use them, can get scheduled so
> early that they get reachable. Instead, we now eagerly remove branches
> that use DeadValue in DeadCodeElimination and replace DeadValue inputs
> to value phi nodes with dummy values.
>
> Reland of https://chromium-review.googlesource.com/715716
>
> Bug: chromium:741225  chromium:776256 
> Change-Id: I251efd507c967d4a8882ad8fd2fd96c4185781fe
> Reviewed-on: https://chromium-review.googlesource.com/727893
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49188}

TBR=jarin@chromium.org,tebbi@chromium.org

Bug: chromium:741225  chromium:776256   chromium:783019   chromium:783035 
Change-Id: I6a8fa3a08ce2824a858ae01817688e63ed1f442e
Reviewed-on: https://chromium-review.googlesource.com/758770
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49262}
[modify] https://crrev.com/c899637debff1e05ac40a1e0d50b0da588df645b/src/compiler/branch-elimination.cc
[modify] https://crrev.com/c899637debff1e05ac40a1e0d50b0da588df645b/src/compiler/common-operator.cc
[modify] https://crrev.com/c899637debff1e05ac40a1e0d50b0da588df645b/src/compiler/common-operator.h
[modify] https://crrev.com/c899637debff1e05ac40a1e0d50b0da588df645b/src/compiler/dead-code-elimination.cc
[modify] https://crrev.com/c899637debff1e05ac40a1e0d50b0da588df645b/src/compiler/dead-code-elimination.h
[modify] https://crrev.com/c899637debff1e05ac40a1e0d50b0da588df645b/src/compiler/effect-control-linearizer.cc
[modify] https://crrev.com/c899637debff1e05ac40a1e0d50b0da588df645b/src/compiler/instruction-selector.cc
[modify] https://crrev.com/c899637debff1e05ac40a1e0d50b0da588df645b/src/compiler/instruction-selector.h
[modify] https://crrev.com/c899637debff1e05ac40a1e0d50b0da588df645b/src/compiler/js-graph.cc
[modify] https://crrev.com/c899637debff1e05ac40a1e0d50b0da588df645b/src/compiler/js-graph.h
[modify] https://crrev.com/c899637debff1e05ac40a1e0d50b0da588df645b/src/compiler/memory-optimizer.cc
[modify] https://crrev.com/c899637debff1e05ac40a1e0d50b0da588df645b/src/compiler/opcodes.h
[modify] https://crrev.com/c899637debff1e05ac40a1e0d50b0da588df645b/src/compiler/pipeline.cc
[modify] https://crrev.com/c899637debff1e05ac40a1e0d50b0da588df645b/src/compiler/representation-change.cc
[modify] https://crrev.com/c899637debff1e05ac40a1e0d50b0da588df645b/src/compiler/simplified-lowering.cc
[modify] https://crrev.com/c899637debff1e05ac40a1e0d50b0da588df645b/src/compiler/typer.cc
[modify] https://crrev.com/c899637debff1e05ac40a1e0d50b0da588df645b/src/compiler/verifier.cc
[delete] https://crrev.com/d1193e3c6ce24394b60717fd21aa042e4d94ce00/test/mjsunit/compiler/regress-772872.js
[delete] https://crrev.com/d1193e3c6ce24394b60717fd21aa042e4d94ce00/test/mjsunit/compiler/regress-773954.js
[modify] https://crrev.com/c899637debff1e05ac40a1e0d50b0da588df645b/test/unittests/compiler/dead-code-elimination-unittest.cc

C#13 was a revert.  

Is there more work pending here?  Please reopen if that's the case.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/19ac10e58af7768b2e4eb57f460169f11f97fcf1

commit 19ac10e58af7768b2e4eb57f460169f11f97fcf1
Author: Tobias Tebbi <tebbi@chromium.org>
Date: Thu Nov 16 20:01:22 2017

Reland^6 "[turbofan] eagerly prune None types and deadness from the graph"

Reland of https://chromium-review.googlesource.com/c/v8/v8/+/727893
The crashes should be fixed by https://chromium-review.googlesource.com/c/v8/v8/+/763531

Original change's description:
> Revert "Reland^5 "[turbofan] eagerly prune None types and deadness from the graph""
> 
> This reverts commit ac0661b358bce7f9af6f23c3e640121f6ca20170.
> 
> Reason for revert: Clusterfuzz unhappy: chromium:783019 chromium:783035
> 
> Original change's description:
> > Reland^5 "[turbofan] eagerly prune None types and deadness from the graph"
> >
> > This gives up on earlier attempts to interpret DeadValue as a signal of
> > unreachable code. This does not work because free-floating dead value
> > nodes, and even pure branch nodes that use them, can get scheduled so
> > early that they get reachable. Instead, we now eagerly remove branches
> > that use DeadValue in DeadCodeElimination and replace DeadValue inputs
> > to value phi nodes with dummy values.
> >
> > Reland of https://chromium-review.googlesource.com/715716
> >
> > Bug: chromium:741225  chromium:776256 
> > Change-Id: I251efd507c967d4a8882ad8fd2fd96c4185781fe
> > Reviewed-on: https://chromium-review.googlesource.com/727893
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#49188}
> 
> TBR=jarin@chromium.org,tebbi@chromium.org
> 
> Bug: chromium:741225  chromium:776256   chromium:783019   chromium:783035 
> Change-Id: I6a8fa3a08ce2824a858ae01817688e63ed1f442e
> Reviewed-on: https://chromium-review.googlesource.com/758770
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49262}

TBR=jarin@chromium.org,tebbi@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:741225  chromium:776256   chromium:783019   chromium:783035 
Change-Id: I6c02b4beb02997ec34015ed2f6791a93c70f5e36
Reviewed-on: https://chromium-review.googlesource.com/772150
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49429}
[modify] https://crrev.com/19ac10e58af7768b2e4eb57f460169f11f97fcf1/src/compiler/branch-elimination.cc
[modify] https://crrev.com/19ac10e58af7768b2e4eb57f460169f11f97fcf1/src/compiler/common-operator.cc
[modify] https://crrev.com/19ac10e58af7768b2e4eb57f460169f11f97fcf1/src/compiler/common-operator.h
[modify] https://crrev.com/19ac10e58af7768b2e4eb57f460169f11f97fcf1/src/compiler/dead-code-elimination.cc
[modify] https://crrev.com/19ac10e58af7768b2e4eb57f460169f11f97fcf1/src/compiler/dead-code-elimination.h
[modify] https://crrev.com/19ac10e58af7768b2e4eb57f460169f11f97fcf1/src/compiler/effect-control-linearizer.cc
[modify] https://crrev.com/19ac10e58af7768b2e4eb57f460169f11f97fcf1/src/compiler/instruction-selector.cc
[modify] https://crrev.com/19ac10e58af7768b2e4eb57f460169f11f97fcf1/src/compiler/instruction-selector.h
[modify] https://crrev.com/19ac10e58af7768b2e4eb57f460169f11f97fcf1/src/compiler/js-graph.cc
[modify] https://crrev.com/19ac10e58af7768b2e4eb57f460169f11f97fcf1/src/compiler/js-graph.h
[modify] https://crrev.com/19ac10e58af7768b2e4eb57f460169f11f97fcf1/src/compiler/memory-optimizer.cc
[modify] https://crrev.com/19ac10e58af7768b2e4eb57f460169f11f97fcf1/src/compiler/opcodes.h
[modify] https://crrev.com/19ac10e58af7768b2e4eb57f460169f11f97fcf1/src/compiler/pipeline.cc
[modify] https://crrev.com/19ac10e58af7768b2e4eb57f460169f11f97fcf1/src/compiler/representation-change.cc
[modify] https://crrev.com/19ac10e58af7768b2e4eb57f460169f11f97fcf1/src/compiler/simplified-lowering.cc
[modify] https://crrev.com/19ac10e58af7768b2e4eb57f460169f11f97fcf1/src/compiler/typer.cc
[modify] https://crrev.com/19ac10e58af7768b2e4eb57f460169f11f97fcf1/src/compiler/verifier.cc
[add] https://crrev.com/19ac10e58af7768b2e4eb57f460169f11f97fcf1/test/mjsunit/compiler/regress-772872.js
[add] https://crrev.com/19ac10e58af7768b2e4eb57f460169f11f97fcf1/test/mjsunit/compiler/regress-773954.js
[modify] https://crrev.com/19ac10e58af7768b2e4eb57f460169f11f97fcf1/test/unittests/compiler/dead-code-elimination-unittest.cc

We fixed the issues associated with this bug. New issues with this feature should be tracked somewhere else.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot