New issue
Advanced search Search tips

Issue 829681 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: 2018-04-09
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

V8 correctness failure in configs: x64,ignition:x64,ignition_turbo_opt

Project Member Reported by ClusterFuzz, Apr 6 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5377824761053184

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition:x64,ignition_turbo_opt
  sources: d51
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=v8_foozzie&range=52377:52378

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5377824761053184

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Apr 6 2018

Labels: Test-Predator-Auto-Owner
Owner: clemensh@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/8f20e60f4171c0737ce5c3d17b72218382b880d2 (Revert "[Liftoff] Implement float rounding").

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Status: WontFix (was: Assigned)
This difference is caused by small differences in the amount of memory used:

e.stack[1073741824].getThis().toString()
>> TypeError: Cannot read property 'getThis' of undefined

Hence, it's a WontFix.
Cc: ahaas@chromium.org
Components: -Blink>JavaScript Blink>JavaScript>WebAssembly
Status: Assigned (was: WontFix)
Reopening. This is not a memory usage difference, but a timing difference because of wasm background compilation. After compilation finishes (after some nondeterministic time), the promise is resolved. This difference can be observed by e.g. repeatedly spawning a new foreground tasks and counting how often you can do that before the wasm promise resolves.

We could try to fix this by forcing foreground compilation if --wasm-num-compilation-tasks=0 is passed. We currently do this for synchronous compilation, but not for asynchronous compilation.
Status: Started (was: Assigned)
Cc: machenb...@chromium.org
+machenbach

I got a CL to make timing deterministic: https://crrev.com/c/999594

What remains to do after that landed is setting --wasm-num-compilation-tasks=0 for all foozzie configs.
Project Member

Comment 6 by bugdroid1@chromium.org, Apr 6 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/ba5b4a323515121fb56feb0a4d5643a54aec4800

commit ba5b4a323515121fb56feb0a4d5643a54aec4800
Author: Michael Achenbach <machenbach@chromium.org>
Date: Fri Apr 06 12:16:36 2018

[foozzie] Make correctness runs deterministic

NOTRY=true

Bug:  chromium:829681 
Change-Id: Iccf9b190e77b1c27fedec74d67f5948803dd1fa9
Reviewed-on: https://chromium-review.googlesource.com/998355
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52437}
[modify] https://crrev.com/ba5b4a323515121fb56feb0a4d5643a54aec4800/tools/clusterfuzz/testdata/failure_output.txt
[modify] https://crrev.com/ba5b4a323515121fb56feb0a4d5643a54aec4800/tools/clusterfuzz/v8_foozzie.py

Project Member

Comment 7 by bugdroid1@chromium.org, Apr 6 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/9136841f5832608bb6a8f305a6cfdbeddf54288e

commit 9136841f5832608bb6a8f305a6cfdbeddf54288e
Author: Clemens Hammacher <clemensh@chromium.org>
Date: Fri Apr 06 13:40:23 2018

[wasm] Eliminate nondeterminism if requested

If --wasm-num-compilation-tasks is set to 0, we spawn all background
tasks as foreground tasks. Semantically, they are still treated like
background tasks, but they will execute interleaved with the foreground
tasks. This should not deadlong since all foreground tasks eventually
return to the event loop.

R=ahaas@chromium.org

Bug:  chromium:829681 
Change-Id: Id57cbb10157c085acd57a3d30a0a43c824a64591
Reviewed-on: https://chromium-review.googlesource.com/999594
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52445}
[modify] https://crrev.com/9136841f5832608bb6a8f305a6cfdbeddf54288e/src/wasm/module-compiler.cc

NextAction: 2018-04-09
Status: Fixed (was: Started)
Should be fixed, let's see if ClusterFuzz verifies it.
The NextAction date has arrived: 2018-04-09
Status: Verified (was: Fixed)
Does not reproduce any more, but Clusterfuzz is confused because with the updated Foozzie configuration, it also does not reproduce on the original CL any more.

Sign in to add a comment