New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 842497 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: May 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Floating-point-exception

Project Member Reported by ClusterFuzz, May 13 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6317430343991296

Fuzzer: mbarbella_js_mutation
Job Type: linux_ubsan_vptr_d8
Platform Id: linux

Crash Type: Floating-point-exception
Crash Address: 
Crash State:
  NULL
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_d8&range=53117:53118

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6317430343991296

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, May 13 2018

Cc: kanghua...@intel.com
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

[turbofan][x64] Reduce compare-zero followed by flags-setting binop by kanghua.yu@intel.com - https://chromium.googlesource.com/v8/v8/+/423343635042c2d9b05a850ebc1d2fc3fc9cc4f5

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
Components: -Blink>JavaScript Blink>JavaScript>Compiler
Owner: bmeu...@chromium.org
Status: Assigned (was: Untriaged)
Summary: Floating-point-exception
Project Member

Comment 3 by bugdroid1@chromium.org, May 15 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/3302242667ee30537f9389a4e395f1f5cfa41648

commit 3302242667ee30537f9389a4e395f1f5cfa41648
Author: Kanghua Yu <kanghua.yu@intel.com>
Date: Tue May 15 06:40:13 2018

Reland "[turbofan][x64] Reduce compare-zero followed by flags-setting binop"

On IA architecture, arithmetic and shifting operations set the flags
according to the computation result.

    subl rsi,0x1
    REX.W movq rbx,[rbx+0x17]
    cmpl rsi, 0                       <-- TO BE REDUCED
    jnz 0x3f54d2dcef0
==>
    REX.W movq rbx,[rbx+0x17]
    subl rsi,0x1
    jnz 0x3f54d2dcef0
&
    orl rdx,rbx
    cmpl rdx,0x0                      <-- TO BE REDUCED
    jnz 0x3f54d22b0f5
==>
    orl rdx,rbx
    jnz 0x3f54d22b0f5

Bug:  chromium:842497 ,  chromium:842501 
Change-Id: I4e2c40861b76ac3f508b01ee27249e85eab3222f
Reviewed-on: https://chromium-review.googlesource.com/1057351
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Kanghua Yu <kanghua.yu@intel.com>
Cr-Commit-Position: refs/heads/master@{#53171}
[modify] https://crrev.com/3302242667ee30537f9389a4e395f1f5cfa41648/src/compiler/x64/instruction-selector-x64.cc
[modify] https://crrev.com/3302242667ee30537f9389a4e395f1f5cfa41648/test/cctest/compiler/test-run-machops.cc

Project Member

Comment 4 by ClusterFuzz, May 15 2018

ClusterFuzz has detected this issue as fixed in range 53136:53137.

Detailed report: https://clusterfuzz.com/testcase?key=6317430343991296

Fuzzer: mbarbella_js_mutation
Job Type: linux_ubsan_vptr_d8
Platform Id: linux

Crash Type: Floating-point-exception
Crash Address: 
Crash State:
  NULL
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_d8&range=53117:53118
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_d8&range=53136:53137

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6317430343991296

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, May 15 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6317430343991296 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment