vm crash on dart fuzzer test - SelectRepresentations at CalculateElementAddressInstr

[aam]

$ dart runtime/tools/dartfuzz/dartfuzz.dart --no-fp --no-ffi --flat --seed 2550109923 fuzz.dart
$ DART_CONFIGURATION='ReleaseX64
[fuzz.zip](https://github.com/dart-lang/sdk/files/15151425/fuzz.zip)
' DART_VM_FLAGS='--enable-asserts' pkg/vm/tool/precompiler2 --deterministic fuzz.dart snapshot
...
../../runtime/vm/compiler/backend/il.h: 1262: error: unreachable code
version=3.5.0-edge (main) (Unknown timestamp) on "linux_x64"
pid=824675, thread=824675, isolate_group=isolate(0x55d2cfd100a0), isolate=(nil)((nil))
os=linux, arch=x64, comp=no, sim=no
isolate_instructions=0, vm_instructions=0
fp=7ffdd42629b0, sp=7ffdd4262880, pc=55d2ce4a6dfc
  pc 0x000055d2ce4a6dfc fp 0x00007ffdd42629b0 dart::Profiler::DumpStackTrace+0x7c
  pc 0x000055d2ce3777f4 fp 0x00007ffdd4262a90 dart::Assert::Fail+0x84
  pc 0x000055d2ce61fc7c fp 0x00007ffdd4262ab0 dart::Instruction::DeoptimizationTarget+0x2c
  pc 0x000055d2ce5f7b28 fp 0x00007ffdd4262b30 dart::FlowGraph::InsertConversion+0x1e8
  pc 0x000055d2ce5f8a1f fp 0x00007ffdd4262b60 dart::FlowGraph::InsertConversionsFor+0x8f
  pc 0x000055d2ce5f910c fp 0x00007ffdd4262c00 dart::FlowGraph::SelectRepresentations+0x6ac
  pc 0x000055d2ce6a23d0 fp 0x00007ffdd4262c10 dart::CompilerPass_SelectRepresentations::DoBody+0x10
  pc 0x000055d2ce6a1b1f fp 0x00007ffdd4262cd0 dart::CompilerPass::Run+0x11f
  pc 0x000055d2ce6a1f8e fp 0x00007ffdd4262cf0 dart::CompilerPass::RunPipeline+0x17e
  pc 0x000055d2ce5bfb84 fp 0x00007ffdd4263430 dart::PrecompileParsedFunctionHelper::Compile+0x584
  pc 0x000055d2ce5c040d fp 0x00007ffdd4263af0 dart::PrecompileFunctionHelper+0x2ed
  pc 0x000055d2ce5bca67 fp 0x00007ffdd4263c00 dart::Precompiler::CompileFunction+0x177
  pc 0x000055d2ce5bba14 fp 0x00007ffdd4263c90 dart::Precompiler::ProcessFunction+0xe4
  pc 0x000055d2ce5b7894 fp 0x00007ffdd4263ce0 dart::Precompiler::Iterate+0x84
  pc 0x000055d2ce5b4947 fp 0x00007ffdd4264470 dart::Precompiler::DoCompileAll+0x1507
  pc 0x000055d2ce5b33d8 fp 0x00007ffdd4264900 dart::Precompiler::CompileAll+0xb8
  pc 0x000055d2ce7267bf fp 0x00007ffdd4264af0 Dart_Precompile+0x28f
  pc 0x000055d2ce371539 fp 0x00007ffdd4264c60 dart::bin::main+0x869
-- End of DumpStackTrace
=== Crash occurred when compiling file:///usr/local/google/home/aam/p/d/d1/sdk/fuzz.dart_::_fooE1|foo1_Extension0 in AOT mode in SelectRepresentations pass
...

cc @sstrickl
fuzz.zip

[alexmarkov]

Unboxing of inputs of CalculateElementAddress instruction should not be speculative.

The following change fixes the crash:

diff --git a/runtime/vm/compiler/backend/il.h b/runtime/vm/compiler/backend/il.h
index f7a616809e8..39b1c999712 100644
--- a/runtime/vm/compiler/backend/il.h
+++ b/runtime/vm/compiler/backend/il.h
@@ -7966,6 +7966,10 @@ class CalculateElementAddressInstr : public TemplateDefinition<3, NoThrow> {
     return kUnboxedIntPtr;
   }
 
+  virtual SpeculativeMode SpeculativeModeOfInput(intptr_t index) const {
+    return kNotSpeculative;
+  }
+
   Value* base() const { return inputs_[kBasePos]; }
   Value* index() const { return inputs_[kIndexPos]; }
   Value* offset() const { return inputs_[kOffsetPos]; }

The tricky part is to create a regression test out of the code generated by dart fuzzer.