Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

various segfaults #38231

Closed
feli-citas opened this issue Sep 5, 2019 · 7 comments
Closed

various segfaults #38231

feli-citas opened this issue Sep 5, 2019 · 7 comments
Assignees
Labels
area-vm Use area-vm for VM related issues, including code coverage, and the AOT and JIT backends. dartfuzz Found with Dart fuzzing (DartFuzz, libFuzzer, etc.)

Comments

@feli-citas
Copy link
Contributor

Isolate (/b/s/w/ityzSOVX/dart_fuzzGBXFMI) NO-FFI NO-FP : JIT-COMPACTEVERY-797-ReleaseIA32 - KBC-MIX-DebugSIMARM64: !DIVERGENCE! 1.37:3507703716 (-6 vs 0)                                                                                                                                 
===== CRASH =====
si_signo=Segmentation fault(11), si_code=1, si_addr=0x9a
version=2.6.0-edge.5a45050d1e165f9790292631724a59688bc36a5a (Thu Sep 5 17:27:06 2019 +0000) on "linux_ia32"
thread=28048, isolate=main(0x41d4700)
  pc 0x0000009a fp 0xf783dbb0 Unknown symbol
  pc 0x0000009a fp 0xf783dbd0 Unknown symbol
  pc 0xf78c0c4d fp 0xf783dbf4 Unknown symbol
  pc 0x019e9d8f fp 0xf783dc68 dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&, dart::Array const&, unsigned int)
  pc 0x019e99e6 fp 0xf783dca8 dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&)
  pc 0x01a6f51e fp 0xf783dd08 dart::Field::EvaluateInitializer() const
  pc 0x01a6f2b7 fp 0xf783dd38 dart::Field::Initialize() const
  pc 0x01b03e1b fp 0xf783dd98 dart::DRT_InitStaticField(dart::NativeArguments)
  pc 0xf78c07d2 fp 0xf783ddbc Unknown symbol
  pc 0xf6f67069 fp 0xf783ddd4 Unknown symbol
  pc 0xf6f665ce fp 0xf783de24 Unknown symbol
  pc 0xf6f65bfa fp 0xf783de50 Unknown symbol
  pc 0xf6f65a40 fp 0xf783de68 Unknown symbol
  pc 0xf6f6593a fp 0xf783de7c Unknown symbol
  pc 0xf6f64df2 fp 0xf783de98 Unknown symbol
  pc 0xf6f486fd fp 0xf783deb0 Unknown symbol
  pc 0xf6f64b40 fp 0xf783dec8 Unknown symbol
  pc 0xf78c0c4d fp 0xf783def4 Unknown symbol
  pc 0x019e9d8f fp 0xf783df68 dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&, dart::Array const&, unsigned int)
  pc 0x019ebbed fp 0xf783dfa8 dart::DartLibraryCalls::HandleMessage(dart::Object const&, dart::Instance const&)
  pc 0x01a1a200 fp 0xf783e0d8 dart::IsolateMessageHandler::HandleMessage(std::__2::unique_ptr<dart::Message, std::__2::default_delete<dart::Message> >)
  pc 0x01a3f805 fp 0xf783e128 dart::MessageHandler::HandleMessages(dart::MonitorLocker*, bool, bool)
  pc 0x01a40071 fp 0xf783e188 dart::MessageHandler::TaskCallback()
  pc 0x01a407c7 fp 0xf783e1a8 /usr/local/google/home/felih/dart-sdk/sdk/out/ReleaseIA32/dart+0x16407c7
  pc 0x01b31771 fp 0xf783e1e8 dart::ThreadPool::Worker::Loop()
  pc 0x01b31617 fp 0xf783e218 dart::ThreadPool::Worker::Main(unsigned int)
  pc 0x01ab3314 fp 0xf783e2d8 /usr/local/google/home/felih/dart-sdk/sdk/out/ReleaseIA32/dart+0x16b3314
  pc 0xf7bd3982 fp 0xf783e3a8 /lib/i386-linux-gnu/libpthread.so.0+0x6982
-- End of DumpStackTrace
@feli-citas feli-citas added area-vm Use area-vm for VM related issues, including code coverage, and the AOT and JIT backends. dartfuzz Found with Dart fuzzing (DartFuzz, libFuzzer, etc.) labels Sep 5, 2019
@feli-citas
Copy link
Contributor Author



Isolate (/b/s/w/itPi0ILn/dart_fuzzAAOCOB) NO-FFI FP : KBC-MIX-DebugSIMARM - KBC-INT-SRC-DebugIA32: !DIVERGENCE! 1.37:1293758372 (0 vs -6)

fail2:
-6


===== CRASH =====
si_signo=Segmentation fault(11), si_code=1, si_addr=0xa8
version=2.6.0-edge.6eed35b60df87f3bb099cf9ce9db5cbccb9ec67a (Thu Sep 5 00:58:46 2019 +0000) on "linux_ia32"
thread=23983, isolate=main(0x3cba700)
  pc 0x000000a8 fp 0xf797be40 Unknown symbol
  pc 0xf7a00c99 fp 0xf797be64 Unknown symbol
  pc 0x01b397e5 fp 0xf797bed8 dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&, dart::Array const&, unsigned int)
  pc 0x01b39405 fp 0xf797bf18 dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&)
  pc 0x01c1a5a6 fp 0xf797bf78 dart::Field::EvaluateInitializer() const
  pc 0x01c1a2a4 fp 0xf797bfb8 dart::Field::Initialize() const
  pc 0x01d11c2a fp 0xf797c038 dart::DRT_InitStaticField(dart::NativeArguments)
  pc 0x01b6e334 fp 0xf797c128 /b/s/w/ir/out/DebugIA32/dart+0x176e334
  pc 0x01b7fb40 fp 0xf797c918 dart::Interpreter::Call(dart::RawFunction*, dart::RawArray*, int, dart::RawObject* const*, dart::Thread*)
  pc 0x01d1201e fp 0xf797c984 dart::RuntimeEntry::InterpretCall(dart::RawFunction*, dart::RawArray*, int, dart::RawObject**, dart::Thread*)
  pc 0xf7a008f4 fp 0xf797c9a4 Unknown symbol
  pc 0xf70e31ce fp 0xf797c9d4 Unknown symbol
  pc 0xf70e2e7b fp 0xf797c9ec Unknown symbol
  pc 0xf7a00d41 fp 0xf797ca14 Unknown symbol
  pc 0x01b6de72 fp 0xf797cb18 dart::Interpreter::InvokeCompiled(dart::Thread*, dart::RawFunction*, dart::RawObject**, dart::RawObject**, unsigned char const**, dart::RawObject***, dart::RawObject***)
  pc 0x01b80884 fp 0xf797d318 dart::Interpreter::Call(dart::RawFunction*, dart::RawArray*, int, dart::RawObject* const*, dart::Thread*)
  pc 0x01d1201e fp 0xf797d37c dart::RuntimeEntry::InterpretCall(dart::RawFunction*, dart::RawArray*, int, dart::RawObject**, dart::Thread*)
  pc 0xf7a008f4 fp 0xf797d39c Unknown symbol
  pc 0xf70e230d fp 0xf797d3b8 Unknown symbol
  pc 0xf7a00d41 fp 0xf797d3e4 Unknown symbol
  pc 0x01b6de72 fp 0xf797d4e8 dart::Interpreter::InvokeCompiled(dart::Thread*, dart::RawFunction*, dart::RawObject**, dart::RawObject**, unsigned char const**, dart::RawObject***, dart::RawObject***)
  pc 0x01b80884 fp 0xf797dce8 dart::Interpreter::Call(dart::RawFunction*, dart::RawArray*, int, dart::RawObject* const*, dart::Thread*)
  pc 0x01d1201e fp 0xf797dd50 dart::RuntimeEntry::InterpretCall(dart::RawFunction*, dart::RawArray*, int, dart::RawObject**, dart::Thread*)
  pc 0xf7a008f4 fp 0xf797dd70 Unknown symbol
  pc 0xf70e205b fp 0xf797dd88 Unknown symbol
  pc 0xf7a00c99 fp 0xf797ddb4 Unknown symbol
  pc 0x01b397e5 fp 0xf797de28 dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&, dart::Array const&, unsigned int)
  pc 0x01b39405 fp 0xf797de68 dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&)
  pc 0x01b3c867 fp 0xf797deb8 dart::DartLibraryCalls::HandleMessage(dart::Object const&, dart::Instance const&)
  pc 0x01b881c9 fp 0xf797dfe8 dart::IsolateMessageHandler::HandleMessage(std::__2::unique_ptr<dart::Message, std::__2::default_delete<dart::Message> >)
  pc 0x01bc6ac0 fp 0xf797e068 dart::MessageHandler::HandleMessages(dart::MonitorLocker*, bool, bool)
  pc 0x01bc7864 fp 0xf797e0c8 dart::MessageHandler::TaskCallback()
  pc 0x01bc8cbc fp 0xf797e0f8 /b/s/w/ir/out/DebugIA32/dart+0x17c8cbc
  pc 0x01d5483f fp 0xf797e148 dart::ThreadPool::Worker::Loop()
  pc 0x01d543da fp 0xf797e198 dart::ThreadPool::Worker::Main(unsigned int)
  pc 0x01c9c3ef fp 0xf797e2e8 /b/s/w/ir/out/DebugIA32/dart+0x189c3ef
  pc 0xf7f5d295 fp 0xf797e3a8 /lib/i386-linux-gnu/libpthread.so.0+0x6295
-- End of DumpStackTrace

@feli-citas
Copy link
Contributor Author

Isolate (/b/s/w/itriGeJb/dart_fuzzEJDRAC) NO-FFI FP : JIT-O3-DebugIA32 - KBC-INT-SLOWPATH-DET-DebugSIMARM: !DIVERGENCE! 1.37:3363228411 (-6 vs 0)

fail1:
-6
foo0 throws
X0().foo0_1() throws
X1().foo1_2() throws
X2().foo2_0() throws
X2().foo2_1() throws
X2().foo2_2() throws
X3().foo3_0() throws
X3().foo3_1() throws
X3().foo3_2() throws
X3().foo3_3() throws
X3().run() throws


===== CRASH =====
si_signo=Segmentation fault(11), si_code=2, si_addr=0xf79c1871
version=2.6.0-edge.6eed35b60df87f3bb099cf9ce9db5cbccb9ec67a (Thu Sep 5 00:58:46 2019 +0000) on "linux_ia32"
thread=4374, isolate=main(0x36c0700)
  pc 0xf79c1871 fp 0xf78fda90 Unknown symbol
  pc 0xf7980c99 fp 0xf78fdab4 Unknown symbol
  pc 0x01b397e5 fp 0xf78fdb28 dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&, dart::Array const&, unsigned int)
  pc 0x01b39405 fp 0xf78fdb68 dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&)
  pc 0x01c1a5a6 fp 0xf78fdbc8 dart::Field::EvaluateInitializer() const
  pc 0x01c1a2a4 fp 0xf78fdc08 dart::Field::Initialize() const
  pc 0x01d11c2a fp 0xf78fdc88 dart::DRT_InitStaticField(dart::NativeArguments)
  pc 0xf7980819 fp 0xf78fdcb0 Unknown symbol
  pc 0xf476f8a9 fp 0xf78fdcc8 Unknown symbol
  pc 0xf7066a7e fp 0xf78fdd10 Unknown symbol
  pc 0xf7064e3b fp 0xf78fdd28 Unknown symbol
  pc 0xf7064d35 fp 0xf78fdd3c Unknown symbol
  pc 0xf706416d fp 0xf78fdd58 Unknown symbol
  pc 0xf7048ad8 fp 0xf78fdd70 Unknown symbol
  pc 0xf7063ebb fp 0xf78fdd88 Unknown symbol
  pc 0xf7980c99 fp 0xf78fddb4 Unknown symbol
  pc 0x01b397e5 fp 0xf78fde28 dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&, dart::Array const&, unsigned int)
  pc 0x01b39405 fp 0xf78fde68 dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&)
  pc 0x01b3c867 fp 0xf78fdeb8 dart::DartLibraryCalls::HandleMessage(dart::Object const&, dart::Instance const&)
  pc 0x01b881c9 fp 0xf78fdfe8 dart::IsolateMessageHandler::HandleMessage(std::__2::unique_ptr<dart::Message, std::__2::default_delete<dart::Message> >)
  pc 0x01bc6ac0 fp 0xf78fe068 dart::MessageHandler::HandleMessages(dart::MonitorLocker*, bool, bool)
  pc 0x01bc7864 fp 0xf78fe0c8 dart::MessageHandler::TaskCallback()
  pc 0x01bc8cbc fp 0xf78fe0f8 /b/s/w/ir/out/DebugIA32/dart+0x17c8cbc
  pc 0x01d5483f fp 0xf78fe148 dart::ThreadPool::Worker::Loop()
  pc 0x01d543da fp 0xf78fe198 dart::ThreadPool::Worker::Main(unsigned int)
  pc 0x01c9c3ef fp 0xf78fe2e8 /b/s/w/ir/out/DebugIA32/dart+0x189c3ef
  pc 0xf7eb3295 fp 0xf78fe3a8 /lib/i386-linux-gnu/libpthread.so.0+0x6295
-- End of DumpStackTrace


@feli-citas
Copy link
Contributor Author

Isolate (/b/s/w/itETUeuI/dart_fuzzXRFPBE) NO-FFI NO-FP : JIT-SLOWPATH-DET-DebugIA32 - KBC-CMP-DebugSIMARM64: !DIVERGENCE! 1.37:3829163003 (-6 vs 0)

fail1:
-6


===== CRASH =====                                                                                                                                                                                                                                                                         
si_signo=Segmentation fault(11), si_code=1, si_addr=0x8c
version=2.6.0-edge.6eed35b60df87f3bb099cf9ce9db5cbccb9ec67a (Thu Sep 5 00:58:46 2019 +0000) on "linux_ia32"
thread=23892, isolate=main(0x3966700)
  pc 0x0000008c fp 0xf793da50 Unknown symbol
  pc 0xf79c0c99 fp 0xf793da74 Unknown symbol
  pc 0x01b397e5 fp 0xf793dae8 dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&, dart::Array const&, unsigned int)
  pc 0x01b39405 fp 0xf793db28 dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&)
  pc 0x01c1a5a6 fp 0xf793db88 dart::Field::EvaluateInitializer() const
  pc 0x01c1a2a4 fp 0xf793dbc8 dart::Field::Initialize() const
  pc 0x01d11c2a fp 0xf793dc48 dart::DRT_InitStaticField(dart::NativeArguments)
  pc 0xf79c0819 fp 0xf793dc68 Unknown symbol
  pc 0xf72aa589 fp 0xf793dc80 Unknown symbol
  pc 0xf72a6c87 fp 0xf793dcd4 Unknown symbol
  pc 0xf72a525d fp 0xf793dd10 Unknown symbol
  pc 0xf72a4e3b fp 0xf793dd28 Unknown symbol
  pc 0xf72a4d35 fp 0xf793dd3c Unknown symbol
  pc 0xf72a416d fp 0xf793dd58 Unknown symbol
  pc 0xf7288ad8 fp 0xf793dd70 Unknown symbol
  pc 0xf72a3ebb fp 0xf793dd88 Unknown symbol
  pc 0xf79c0c99 fp 0xf793ddb4 Unknown symbol
  pc 0x01b397e5 fp 0xf793de28 dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&, dart::Array const&, unsigned int)
  pc 0x01b39405 fp 0xf793de68 dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&)
  pc 0x01b3c867 fp 0xf793deb8 dart::DartLibraryCalls::HandleMessage(dart::Object const&, dart::Instance const&)
  pc 0x01b881c9 fp 0xf793dfe8 dart::IsolateMessageHandler::HandleMessage(std::__2::unique_ptr<dart::Message, std::__2::default_delete<dart::Message> >)
  pc 0x01bc6ac0 fp 0xf793e068 dart::MessageHandler::HandleMessages(dart::MonitorLocker*, bool, bool)
  pc 0x01bc7864 fp 0xf793e0c8 dart::MessageHandler::TaskCallback()
  pc 0x01bc8cbc fp 0xf793e0f8 /b/s/w/ir/out/DebugIA32/dart+0x17c8cbc
  pc 0x01d5483f fp 0xf793e148 dart::ThreadPool::Worker::Loop()
  pc 0x01d543da fp 0xf793e198 dart::ThreadPool::Worker::Main(unsigned int)
  pc 0x01c9c3ef fp 0xf793e2e8 /b/s/w/ir/out/DebugIA32/dart+0x189c3ef
  pc 0xf7efc295 fp 0xf793e3a8 /lib/i386-linux-gnu/libpthread.so.0+0x6295
-- End of DumpStackTrace

@feli-citas
Copy link
Contributor Author


Isolate (/b/s/w/itkXbRRf/dart_fuzzMQOOQX) FFI NO-FP : KBC-CMP-SRC-DebugIA32 - JIT-OPTCOUNTER-ReleaseX64: !DIVERGENCE! 1.37:400751791 (0 vs -6)

fail2:
-6
foo0 throws
foo1 throws
-15
foo2 throws
-15
foo4 throws
X0().foo0_1() throws
X1().foo1_0() throws
X1().foo1_1() throws
X1().foo1_2() throws
X2().foo2_0() throws


===== CRASH =====
si_signo=Segmentation fault(11), si_code=1, si_addr=(nil)
version=2.6.0-edge.6eed35b60df87f3bb099cf9ce9db5cbccb9ec67a (Thu Sep 5 00:58:46 2019 +0000) on "linux_x64"
thread=2826, isolate=main(0x559e14198100)
  pc 0x0000559e12a5ae21 fp 0x00007f5e9797d9c0 dart::JoinEntryInstr::RemoveDeadPhis(dart::Definition*)
  pc 0x0000559e12a41e38 fp 0x00007f5e9797da10 dart::FlowGraph::RemoveDeadPhis(dart::GrowableArray<dart::PhiInstr*>*)
  pc 0x0000559e12a40e16 fp 0x00007f5e9797db60 dart::FlowGraph::ComputeSSA(long, dart::ZoneGrowableArray<dart::Definition*>*)
  pc 0x0000559e12ae4cb1 fp 0x00007f5e9797db70 /b/s/w/ir/out/ReleaseX64/dart+0x1a9fcb1
  pc 0x0000559e12ae4596 fp 0x00007f5e9797dc00 dart::CompilerPass::Run(dart::CompilerPassState*) const
  pc 0x0000559e12ae49ba fp 0x00007f5e9797dc20 dart::CompilerPass::RunPipeline(dart::CompilerPass::PipelineMode, dart::CompilerPassState*)
  pc 0x0000559e12b5df5d fp 0x00007f5e9797e2a0 dart::CompileParsedFunctionHelper::Compile(dart::CompilationPipeline*)
  pc 0x0000559e12b5e8f7 fp 0x00007f5e9797e4a0 /b/s/w/ir/out/ReleaseX64/dart+0x1b198f7
  pc 0x0000559e12b5f164 fp 0x00007f5e9797e540 dart::Compiler::CompileOptimizedFunction(dart::Thread*, dart::Function const&, long)
  pc 0x0000559e129be2d1 fp 0x00007f5e9797e750 dart::DRT_StackOverflow(dart::NativeArguments)
  pc 0x00007f5e9cf01108 fp 0x00007f5e9797e790 Unknown symbol
  pc 0x00007f5e98b78500 fp 0x00007f5e9797e840 Unknown symbol
  pc 0x00007f5e98b737a0 fp 0x00007f5e9797e880 Unknown symbol
  pc 0x00007f5e98b73254 fp 0x00007f5e9797e8b8 Unknown symbol
  pc 0x00007f5e98b7249c fp 0x00007f5e9797e900 Unknown symbol
  pc 0x00007f5e98b53d81 fp 0x00007f5e9797e930 Unknown symbol
  pc 0x00007f5e98b7216b fp 0x00007f5e9797e968 Unknown symbol
  pc 0x00007f5e9cf0166c fp 0x00007f5e9797e9d8 Unknown symbol
  pc 0x0000559e12843756 fp 0x00007f5e9797ea80 dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&, dart::Array const&, unsigned long)
  pc 0x0000559e12846c06 fp 0x00007f5e9797eae0 dart::DartLibraryCalls::HandleMessage(dart::Object const&, dart::Instance const&)
  pc 0x0000559e128848b2 fp 0x00007f5e9797ece0 dart::IsolateMessageHandler::HandleMessage(std::__2::unique_ptr<dart::Message, std::__2::default_delete<dart::Message> >)
  pc 0x0000559e128b856d fp 0x00007f5e9797ed50 dart::MessageHandler::HandleMessages(dart::MonitorLocker*, bool, bool)
  pc 0x0000559e128b8db6 fp 0x00007f5e9797edb0 dart::MessageHandler::TaskCallback()
  pc 0x0000559e129f6407 fp 0x00007f5e9797ede0 dart::ThreadPool::Worker::Loop()
  pc 0x0000559e129f62a5 fp 0x00007f5e9797ee20 dart::ThreadPool::Worker::Main(unsigned long)
  pc 0x0000559e1295d139 fp 0x00007f5e9797eed0 /b/s/w/ir/out/ReleaseX64/dart+0x1918139
-- End of DumpStackTrace

@feli-citas
Copy link
Contributor Author

Isolate (/b/s/w/itkXbRRf/dart_fuzzMQOOQX) FFI NO-FP : KBC-CMP-SRC-DebugIA32 - JIT-OPTCOUNTER-ReleaseX64: !DIVERGENCE! 1.37:958096358 (0 vs -6)

fail2:
-6
foo2 throws
X0().foo0_0() throws


===== CRASH =====                                                                                                                                                                                                                                                                         
si_signo=Segmentation fault(11), si_code=1, si_addr=(nil)
version=2.6.0-edge.6eed35b60df87f3bb099cf9ce9db5cbccb9ec67a (Thu Sep 5 00:58:46 2019 +0000) on "linux_x64"
thread=2704, isolate=main(0x563f54840100)
  pc 0x0000563f53470e21 fp 0x00007f2f945fb9e0 dart::JoinEntryInstr::RemoveDeadPhis(dart::Definition*)
  pc 0x0000563f53457e38 fp 0x00007f2f945fba30 dart::FlowGraph::RemoveDeadPhis(dart::GrowableArray<dart::PhiInstr*>*)
  pc 0x0000563f53456e16 fp 0x00007f2f945fbb80 dart::FlowGraph::ComputeSSA(long, dart::ZoneGrowableArray<dart::Definition*>*)
  pc 0x0000563f534facb1 fp 0x00007f2f945fbb90 /b/s/w/ir/out/ReleaseX64/dart+0x1a9fcb1
  pc 0x0000563f534fa596 fp 0x00007f2f945fbc20 dart::CompilerPass::Run(dart::CompilerPassState*) const
  pc 0x0000563f534fa9ba fp 0x00007f2f945fbc40 dart::CompilerPass::RunPipeline(dart::CompilerPass::PipelineMode, dart::CompilerPassState*)
  pc 0x0000563f53573f5d fp 0x00007f2f945fc2c0 dart::CompileParsedFunctionHelper::Compile(dart::CompilationPipeline*)
  pc 0x0000563f535748f7 fp 0x00007f2f945fc4c0 /b/s/w/ir/out/ReleaseX64/dart+0x1b198f7
  pc 0x0000563f53575164 fp 0x00007f2f945fc560 dart::Compiler::CompileOptimizedFunction(dart::Thread*, dart::Function const&, long)
  pc 0x0000563f533d42d1 fp 0x00007f2f945fc770 dart::DRT_StackOverflow(dart::NativeArguments)
  pc 0x00007f2f99941108 fp 0x00007f2f945fc7b0 Unknown symbol
  pc 0x00007f2f98d34632 fp 0x00007f2f945fc840 Unknown symbol
  pc 0x00007f2f98d329a0 fp 0x00007f2f945fc880 Unknown symbol
  pc 0x00007f2f98d327d4 fp 0x00007f2f945fc8b8 Unknown symbol
  pc 0x00007f2f98d3169c fp 0x00007f2f945fc900 Unknown symbol
  pc 0x00007f2f98d12181 fp 0x00007f2f945fc930 Unknown symbol
  pc 0x00007f2f98d3136b fp 0x00007f2f945fc968 Unknown symbol
  pc 0x00007f2f9994166c fp 0x00007f2f945fc9d8 Unknown symbol
  pc 0x0000563f53259756 fp 0x00007f2f945fca80 dart::DartEntry::InvokeFunction(dart::Function const&, dart::Array const&, dart::Array const&, unsigned long)
  pc 0x0000563f5325cc06 fp 0x00007f2f945fcae0 dart::DartLibraryCalls::HandleMessage(dart::Object const&, dart::Instance const&)
  pc 0x0000563f5329a8b2 fp 0x00007f2f945fcce0 dart::IsolateMessageHandler::HandleMessage(std::__2::unique_ptr<dart::Message, std::__2::default_delete<dart::Message> >)
  pc 0x0000563f532ce56d fp 0x00007f2f945fcd50 dart::MessageHandler::HandleMessages(dart::MonitorLocker*, bool, bool)
  pc 0x0000563f532cedb6 fp 0x00007f2f945fcdb0 dart::MessageHandler::TaskCallback()
  pc 0x0000563f5340c407 fp 0x00007f2f945fcde0 dart::ThreadPool::Worker::Loop()
  pc 0x0000563f5340c2a5 fp 0x00007f2f945fce20 dart::ThreadPool::Worker::Main(unsigned long)
  pc 0x0000563f53373139 fp 0x00007f2f945fced0 /b/s/w/ir/out/ReleaseX64/dart+0x1918139
-- End of DumpStackTrace

@aartbik aartbik assigned bkonyi, aartbik and feli-citas and unassigned aartbik and feli-citas Sep 5, 2019
@aartbik
Copy link
Contributor

aartbik commented Sep 5, 2019

There are a lot of these in our nightly. It seems to be all happening in

dart::JoinEntryInstr::RemoveDeadPhis(dart::Definition*)

Easy to reproduce:

dart --optimization_counter_threshold=1 fuzz2292463410.dart

Also, unfortunately, this passes, pointing rather heavily to OSR (probably due to the new control-flow-collection testing):

dart --optimization_counter_threshold=1 --use_osr=false fuzz2292463410.dart

fuzz2292463410.dart.txt

dart-bot pushed a commit that referenced this issue Sep 6, 2019
Rationale:
I need a bit more time to investigate the failures.
No need to have massive amounts of divergences in
our nightly in the meantime.

#38231

Change-Id: I2fee0ba36292a2a38fce1d9a4727e5c4b74f0f1c
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/115842
Reviewed-by: Felicitas Hetzelt <felih@google.com>
Commit-Queue: Aart Bik <ajcbik@google.com>
@aartbik
Copy link
Contributor

aartbik commented Sep 10, 2019

Fix out for review:

https://dart-review.googlesource.com/c/sdk/+/116545

dart-bot pushed a commit that referenced this issue Sep 10, 2019
Rationale:
Let's stress test this feature again. Note
that this will increase the number of skipped
tests quite a bit since the CFE complains
about a lot of the generated constructs.
It is still TBD to find out if this is
in the grammar or in the FE.

#38231

Change-Id: Iec4bcb2aa9039f5b01293f82e3e156cc2e35414f
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/116663
Reviewed-by: Felicitas Hetzelt <felih@google.com>
Reviewed-by: Ben Konyi <bkonyi@google.com>
Commit-Queue: Aart Bik <ajcbik@google.com>
dart-bot pushed a commit that referenced this issue Sep 13, 2019
Rationale:
Leaving a push argument on the stack in slightly more
complex flow graphs (try-catch, loop back, conditinals)
required a bit more bookkeeping. This CL also introduces
more integrity checks to make sure the stack is as
expected at each block and instruction.

Note:
Fuzzer is regression test for new feature.

#38231

Change-Id: I8f7e605937d76c1a429df601e69380111737dd94
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/116545
Commit-Queue: Aart Bik <ajcbik@google.com>
Reviewed-by: Alexander Markov <alexmarkov@google.com>
@aartbik aartbik closed this as completed Sep 13, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area-vm Use area-vm for VM related issues, including code coverage, and the AOT and JIT backends. dartfuzz Found with Dart fuzzing (DartFuzz, libFuzzer, etc.)
Projects
None yet
Development

No branches or pull requests

3 participants