AOT-ReleaseX64 segfault

[aartbik]

Reproduces on ToT.

Isolate (/b/s/w/itTQ5HWJ/dart_fuzzOPFNNB) AOT-ReleaseX64 - KBC-CMP-ReleaseX64: !DIVERGENCE! 1.2:3608420507 (output=false)

fail1:

===== CRASH =====
version=2.2.0-edge.e64428a8395179f534fee45ca9a831e6c2c39d03 (Fri Jan 18 01:41:18 2019 +0000) on "linux_x64"
si_signo=Segmentation fault(11), si_code=1, si_addr=0x8
thread=461, isolate=isolate(0x556c3fada900)
[0x0000556c3eb2c904] Unknown symbol
[0x0000556c3eb2c904] Unknown symbol
[0x0000556c3eafa4bf] Unknown symbol
[0x0000556c3eac3f90] Unknown symbol
[0x0000556c3eac57fe] Unknown symbol
[0x0000556c3eac0e05] Unknown symbol
[0x0000556c3eabf86a] Unknown symbol
[0x0000556c3eaba924] Unknown symbol
[0x0000556c3eab8460] Unknown symbol
[0x0000556c3eab8034] Unknown symbol
[0x0000556c3ec0de9a] Unknown symbol
[0x0000556c3e864170] Unknown symbol
-- End of DumpStackTrace

[aartbik]

The stack trace is awful on the crash, but it happens during

slow_path->GenerateCode(this);

when generating the code for the following "CheckedSmiComparison":

B98 pre=36 post=29--> dom=B48 doms(#2)=B53,B168, preds=B48, <--
336: B98[target]:28 ParallelMove rax <- S+2, rcx <- C
338: v857 <- UnboxedConstant(#1) [1, 1] T{_Smi}
340: v484 <- LoadField(v2 T{X2} . fld2_1) T{_InternalLinkedHashMap}
342: PushArgument(v484)
344: PushArgument(v14)
346: v489 <- StaticCall:38( foo1<0> v484, v14) T{int?} env deopt!
347: ParallelMove rcx <- rax, rax <- C
348: Branch if CheckedSmiComparison:40(!=, v86, v489) T{bool} goto (168, 53)

[aartbik]

Digging deeper, crashes while accessing Selector() on the static call

v491 <- StaticCall:40( ==<0> v86, v489, recognized_kind = Integer_equal) T{bool}

because the underlying call does not have ic_data()

     if (auto static_call = this->AsStaticCall()) {
       return static_call->ic_data()->target_name();
     }

Adding an ASSERT confirms this.

[aartbik]

The problem may have been introduces by the unification CL (https://dart-review.googlesource.com/c/sdk/+/84433) which moved static calls into the realm of possibilities for a rewrite into a CheckedSmiComparison without proper check for ic_data().

[aartbik]

Martin, would you mind having a quick look?

[mkustermann]

@aartbik Sure, I can take a look. How do I get the reproduction command from the fuzzer run?

[aartbik]

Thanks Martin. As for reproducing, I have a small write-up on how to do this on go/dartfuzz, but also attached (fuzz3608420507.dart as fuzz3608420507.txt) for your convenience. To reproduce

precompiler2 fuzz3608420507.dart blob.bin

../../runtime/vm/compiler/backend/il.h: 3104: error: expected: static_call->ic_data() != nullptr

(note that the check fail is new, introduced above for more graceful failure).

fuzz3608420507.txt