New issue
Advanced search Search tips

Issue 888264 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Sep 28
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android
Pri: 1
Type: Bug



Sign in to add a comment

UNREACHABLE in ArmOperandConverter::ToImmediate

Project Member Reported by ClusterFuzz, Sep 22

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4612142496743424

Fuzzer: binaryen_wasm_fuzzer
Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: Ill
Crash Address: 0xf24d60c7
Crash State:
  NULL
Sanitizer: address (ASAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4612142496743424

No crash found using linux_d8_dbg job.

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.

Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. We will auto-close the bug if the crash is not seen for 14 days.
 
Project Member

Comment 1 by ClusterFuzz, Sep 23

Labels: OS-Android
Project Member

Comment 2 by ClusterFuzz, Sep 24

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://clusterfuzz.com/testcase?key=5436255343738880.
Project Member

Comment 3 by ClusterFuzz, Sep 24

Testcase 5436255343738880 failed to reproduce the crash. Please inspect the program output at https://clusterfuzz.com/testcase?key=5436255343738880.
Project Member

Comment 4 by ClusterFuzz, Sep 24

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://clusterfuzz.com/testcase?key=6242564284612608.
Project Member

Comment 5 by ClusterFuzz, Sep 24

Labels: Fuzz-Blocker ReleaseBlock-Beta M-71
This crash occurs very frequently on linux platform and is likely preventing the fuzzer  from making much progress. Fixing this will allow more bugs to be found.

Marking this bug as a blocker for next Beta release.

If this is incorrect, please add ClusterFuzz-Wrong label and remove the ReleaseBlock-Beta label.
Components: -Blink>JavaScript Blink>JavaScript>WebAssembly
Owner: gdeepti@chromium.org
Summary: UNREACHABLE in ArmOperandConverter::ToImmediate
Deepti, PTAL. Bisects to 9a0f25468712cf54872778924b2eb33a0bf3cf6a ("[compiler] Remove AtomicNarrow machine operators, macroize tests").
Status: Assigned (was: Untriaged)
Project Member

Comment 8 by ClusterFuzz, Sep 24

Detailed report: https://clusterfuzz.com/testcase?key=6242564284612608

Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: Ill
Crash Address: 0xf2484037
Crash State:
  v8::internal::compiler::ArmOperandConverter::ToImmediate
  v8::internal::compiler::CodeGenerator::AssembleMove
  v8::internal::compiler::CodeGenerator::AssembleMove
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_v8_arm_dbg&range=55498:55499

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6242564284612608

See https://github.com/google/clusterfuzz-tools for more information.
Project Member

Comment 9 by ClusterFuzz, Sep 28

ClusterFuzz has detected this issue as fixed in range 56253:56254.

Detailed report: https://clusterfuzz.com/testcase?key=6242564284612608

Job Type: linux_asan_d8_v8_arm_dbg
Platform Id: linux

Crash Type: Ill
Crash Address: 0xf2484037
Crash State:
  v8::internal::compiler::ArmOperandConverter::ToImmediate
  v8::internal::compiler::CodeGenerator::AssembleMove
  v8::internal::compiler::CodeGenerator::AssembleMove
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_d8_v8_arm_dbg&range=55498:55499
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_d8_v8_arm_dbg&range=56253:56254

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6242564284612608

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 10 by ClusterFuzz, Sep 28

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6242564284612608 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment