DCHECK failure in (GetReplacementOf(replacement)) == nullptr in escape-analysis.cc |
|||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5779698482413568 Fuzzer: ochang_js_fuzzer Job Type: linux_asan_d8_dbg Platform Id: linux Crash Type: DCHECK failure Crash Address: Crash State: (GetReplacementOf(replacement)) == nullptr in escape-analysis.cc v8::internal::compiler::EscapeAnalysisTracker::ResolveReplacement ValueInput Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_dbg&range=49024:49025 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5779698482413568 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Dec 9 2017
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/563ddadc7abd6d93fe2319f9b4d13023af48ee07 (Revert "Disable --turbo-inline-array-builtins by default."). If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
,
Dec 10 2017
,
Dec 11 2017
,
Dec 11 2017
We found first a smaller issuer where a TRACE statement didn't account for replacement possibly being null. After that we still die when violating DCHECK_NULL(GetReplacementOf(replacement)); We saw that we inline a function into itself *through* the forEach builtin inlining. Technically, this doesn't violate our heuristics...we eventually get to a minimum frequency (FLAG_min_inlining_frequency) and stop inlining. But the graph is huge... Tobias will look into how a replacement node got a replacement, which is the no-go.
,
Dec 11 2017
,
Dec 11 2017
Fixed with https://chromium-review.googlesource.com/c/v8/v8/+/817777 This bug is harmless: The DCHECK was checking an invariant that only holds once we reach a fixed-point. |
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by ClusterFuzz
, Dec 9 2017Labels: Test-Predator-Auto-Components