New issue
Advanced search Search tips

Issue 860766 link

Starred by 2 users

Issue metadata

Status: Duplicate
Merged: issue 857383
Owner:
Closed: Jul 18
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Fatal error in int64-lowering.cc

Project Member Reported by ClusterFuzz, Jul 6

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6612060516122624

Fuzzer: binaryen_wasm_fuzzer
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: Fatal error
Crash Address: 
Crash State:
  int64-lowering.cc
  
Sanitizer: address (ASAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6612060516122624

No crash found using linux_d8_dbg job.

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.

Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. We will auto-close the bug if the crash is not seen for 14 days.
 
Project Member

Comment 1 by ClusterFuzz, Jul 6

Components: Blink>JavaScript>Compiler
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jul 17

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://clusterfuzz.com/testcase?key=5581456982933504.
Project Member

Comment 3 by ClusterFuzz, Jul 17

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://clusterfuzz.com/testcase?key=6347432926117888.
Project Member

Comment 4 by ClusterFuzz, Jul 17

Detailed report: https://clusterfuzz.com/testcase?key=6347432926117888

Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  result in int64-lowering.cc
  V8_Dcheck
  v8::internal::compiler::Int64Lowering::LowerNode
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_v8_arm_dbg&range=52252:52253

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6347432926117888

See https://github.com/google/clusterfuzz-tools for more information.
Cc: jarin@chromium.org ahaas@chromium.org
Owner: gdeepti@chromium.org
Status: Assigned (was: Untriaged)
Deepti, could you take a look? It bisects to your CL.
Labels: -Pri-1 Pri-2
Mergedinto: 857383
Status: Duplicate (was: Assigned)
The binaryen fuzzer enables atomic opcodes by default, these are behind a flag in Chrome (--experimental-wasm-threads). This should be auto-fixed when the rest of the I64Atomic operations are implemented on arm. 
Project Member

Comment 7 by ClusterFuzz, Jul 18

Detailed report: https://clusterfuzz.com/testcase?key=6347432926117888

Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  result in int64-lowering.cc
  V8_Dcheck
  v8::internal::compiler::Int64Lowering::LowerNode
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_v8_arm_dbg&range=52252:52253

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6347432926117888

See https://github.com/google/clusterfuzz-tools for more information.
Labels: ClusterFuzz-Ignore
Project Member

Comment 9 by ClusterFuzz, Aug 10

ClusterFuzz has detected this issue as fixed in range 55026:55027.

Detailed report: https://clusterfuzz.com/testcase?key=6347432926117888

Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: DCHECK failure
Crash Address: 
Crash State:
  result in int64-lowering.cc
  V8_Dcheck
  v8::internal::compiler::Int64Lowering::LowerNode
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_v8_arm_dbg&range=52252:52253
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_v8_arm_dbg&range=55026:55027

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6347432926117888

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment