Fatal error in liftoff-register.h |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5756860946448384 Fuzzer: binaryen_wasm_fuzzer Job Type: linux_asan_d8_v8_arm_dbg Platform Id: linux Crash Type: Fatal error Crash Address: Crash State: liftoff-register.h Sanitizer: address (ASAN) Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5756860946448384 No crash found using linux_d8_dbg job. Issue filed automatically. See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally. Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. We will auto-close the bug if the crash is not seen for 14 days.
,
Jan 18
(4 days ago)
Reproduces locally: # # Fatal error in ../../src/wasm/baseline/liftoff-register.h, line 166 # Debug check failed: is_pair() == other.is_pair() (1 vs. 0). #
,
Jan 18
(4 days ago)
Reproducer:
load('test/mjsunit/wasm/wasm-constants.js');
load('test/mjsunit/wasm/wasm-module-builder.js');
const builder = new WasmModuleBuilder();
const sig = builder.addType(makeSig([kWasmI32], []));
builder.addFunction(undefined, sig)
.addLocals({i64_count: 1})
.addBody([
kExprLoop, kWasmI32,
kExprGetLocal, 1,
kExprI64Const, 1,
kExprLoop, kWasmI32,
kExprGetLocal, 0,
kExprI32Const, 1,
kExprI32Const, 1,
kExprIf, kWasmI32,
kExprI32Const, 1,
kExprElse,
kExprUnreachable,
kExprEnd,
kExprSelect,
kExprUnreachable,
kExprEnd,
kExprEnd
]);
builder.instantiate();
,
Yesterday
(42 hours ago)
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/f77299e1f5412501184b46806ab0967f32de0b6c commit f77299e1f5412501184b46806ab0967f32de0b6c Author: Clemens Hammacher <clemensh@chromium.org> Date: Mon Jan 21 11:52:17 2019 [Liftoff] Fix DCHECK error Fix fixes a minor DCHECK error, which fired because usually only LiftoffRegisters of the same type should be compared against each other. In the RegisterReuseMap we store both register pairs and single registers, hence check for pair vs non-pair comparisons explicitly. R=ahaas@chromium.org Bug: v8:6600, chromium:922670 Change-Id: I18beb61b6b1906cc42bcf6e7dfdd5eb803e874d7 Reviewed-on: https://chromium-review.googlesource.com/c/1421921 Reviewed-by: Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#58956} [modify] https://crrev.com/f77299e1f5412501184b46806ab0967f32de0b6c/src/wasm/baseline/liftoff-assembler.cc [add] https://crrev.com/f77299e1f5412501184b46806ab0967f32de0b6c/test/mjsunit/regress/wasm/regress-922670.js
,
Yesterday
(42 hours ago)
|
|||
►
Sign in to add a comment |
|||
Comment 1 by clemensh@chromium.org
, Jan 18 (4 days ago)Owner: clemensh@chromium.org
Status: Assigned (was: Untriaged)