Skip to content

[VM] Crash when hot reloading top level static tearoffs with mismatched parameter counts. #59671

@Markzipan

Description

@Markzipan

Crash:

../../runtime/vm/object.h: 8531: error: Handle check failed: saw sentinel expected Instance
version=3.7.0-edge.a348c85e1b467148f7983be5a80d51ba623e9ac5 (main) (Thu Dec 5 19:21:50 2024 +0000) on "macos_arm64"
pid=24786, thread=14859, isolate_group=main(0x136008200), isolate=main(0x13600fa00)
os=macos, arch=arm64, comp=no, sim=no
isolate_instructions=1028f98e0, vm_instructions=1028f98e0
fp=16dfb5b10, sp=16dfb5ae0, pc=102b7fc1c
  pc 0x0000000102b7fc1c fp 0x000000016dfb5b10 /Users/markzipan/Projects/dart-sdk/sdk/xcodebuild/ReleaseARM64/dart-sdk/bin/dart+0x2b7c1c
  pc 0x00000001028f9aa8 fp 0x000000016dfb5b30 /Users/markzipan/Projects/dart-sdk/sdk/xcodebuild/ReleaseARM64/dart-sdk/bin/dart+0x31aa8
  pc 0x0000000102a4e6dc fp 0x000000016dfb5b70 /Users/markzipan/Projects/dart-sdk/sdk/xcodebuild/ReleaseARM64/dart-sdk/bin/dart+0x1866dc
  pc 0x0000000102b98990 fp 0x000000016dfb6140 /Users/markzipan/Projects/dart-sdk/sdk/xcodebuild/ReleaseARM64/dart-sdk/bin/dart+0x2d0990
  pc 0x000000010500348c fp 0x000000016dfb6188 Unknown symbol
  pc 0x0000000105004a2c fp 0x000000016dfb61d8 Unknown symbol
  pc 0x00000001313bddf4 fp 0x000000016dfb6208 Unknown symbol
  pc 0x00000001313bdcec fp 0x000000016dfb6238 Unknown symbol
  pc 0x00000001313bdc08 fp 0x000000016dfb6260 Unknown symbol
  pc 0x0000000108329bb4 fp 0x000000016dfb62f8 Unknown symbol
  pc 0x00000001083333cc fp 0x000000016dfb6348 Unknown symbol
  pc 0x0000000108333208 fp 0x000000016dfb63a0 Unknown symbol
  pc 0x0000000108332e18 fp 0x000000016dfb63f0 Unknown symbol
  pc 0x00000001083329f8 fp 0x000000016dfb6450 Unknown symbol
  pc 0x00000001083318d4 fp 0x000000016dfb64d0 Unknown symbol
  pc 0x0000000108330278 fp 0x000000016dfb6518 Unknown symbol
  pc 0x000000010832ffc0 fp 0x000000016dfb6558 Unknown symbol
  pc 0x000000010832fcbc fp 0x000000016dfb65a0 Unknown symbol
  pc 0x000000010832f820 fp 0x000000016dfb65e0 Unknown symbol
  pc 0x000000010832f708 fp 0x000000016dfb6608 Unknown symbol
  pc 0x000000010832d778 fp 0x000000016dfb6648 Unknown symbol
  pc 0x0000000108325e6c fp 0x000000016dfb6688 Unknown symbol
  pc 0x0000000105003a84 fp 0x000000016dfb6760 Unknown symbol
  pc 0x0000000102aa9ff4 fp 0x000000016dfb67d0 /Users/markzipan/Projects/dart-sdk/sdk/xcodebuild/ReleaseARM64/dart-sdk/bin/dart+0x1e1ff4
  pc 0x0000000102aab9c4 fp 0x000000016dfb6810 /Users/markzipan/Projects/dart-sdk/sdk/xcodebuild/ReleaseARM64/dart-sdk/bin/dart+0x1e39c4
  pc 0x0000000102aca7bc fp 0x000000016dfb6dc0 /Users/markzipan/Projects/dart-sdk/sdk/xcodebuild/ReleaseARM64/dart-sdk/bin/dart+0x2027bc
  pc 0x0000000102aeda04 fp 0x000000016dfb6e30 /Users/markzipan/Projects/dart-sdk/sdk/xcodebuild/ReleaseARM64/dart-sdk/bin/dart+0x225a04
  pc 0x0000000102aede14 fp 0x000000016dfb6e90 /Users/markzipan/Projects/dart-sdk/sdk/xcodebuild/ReleaseARM64/dart-sdk/bin/dart+0x225e14
  pc 0x0000000102bc96bc fp 0x000000016dfb6f20 /Users/markzipan/Projects/dart-sdk/sdk/xcodebuild/ReleaseARM64/dart-sdk/bin/dart+0x3016bc
  pc 0x0000000102bc9908 fp 0x000000016dfb6f50 /Users/markzipan/Projects/dart-sdk/sdk/xcodebuild/ReleaseARM64/dart-sdk/bin/dart+0x301908
  pc 0x0000000102b7d044 fp 0x000000016dfb6fc0 /Users/markzipan/Projects/dart-sdk/sdk/xcodebuild/ReleaseARM64/dart-sdk/bin/dart+0x2b5044
  pc 0x00000001a01e5f94 fp 0x000000016dfb6fe0 _pthread_start+0x88
-- End of DumpStackTrace
  pc 0x0000000000000000 fp 0x000000016dfb6188 sp 0x0000000000000000 [Stub] CallToRuntime
  pc 0x0000000105004a2c fp 0x000000016dfb61d8 sp 0x000000016dfb6198 [Stub] OneArgCheckInlineCache
  pc 0x00000001313bddf4 fp 0x000000016dfb6208 sp 0x000000016dfb61e8 [Unoptimized] h
  pc 0x00000001313bdcec fp 0x000000016dfb6238 sp 0x000000016dfb6218 [Unoptimized] reloadExample
  pc 0x00000001313bdc08 fp 0x000000016dfb6260 sp 0x000000016dfb6248 [Unoptimized] reloadExample
  pc 0x0000000108329bb4 fp 0x000000016dfb62f8 sp 0x000000016dfb6270 [Unoptimized] run
  pc 0x00000001083333cc fp 0x000000016dfb6348 sp 0x000000016dfb6308 [Unoptimized] _SuspendState@5048458._createAsyncCallbacks@5048458.thenCallback
  pc 0x0000000108333208 fp 0x000000016dfb63a0 sp 0x000000016dfb6358 [Unoptimized] _RootZone@5048458.runUnary
  pc 0x0000000108332e18 fp 0x000000016dfb63f0 sp 0x000000016dfb63b0 [Unoptimized] _FutureListener@5048458.handleValue
  pc 0x00000001083329f8 fp 0x000000016dfb6450 sp 0x000000016dfb6400 [Unoptimized] _Future@5048458._propagateToListeners@5048458.handleValueCallback
  pc 0x00000001083318d4 fp 0x000000016dfb64d0 sp 0x000000016dfb6460 [Unoptimized] _Future@5048458._propagateToListeners@5048458
  pc 0x0000000108330278 fp 0x000000016dfb6518 sp 0x000000016dfb64e0 [Unoptimized] _Future@5048458._completeWithValue@5048458
  pc 0x000000010832ffc0 fp 0x000000016dfb6558 sp 0x000000016dfb6528 [Unoptimized] _Future@5048458._asyncCompleteWithValue@5048458.<anonymous closure>
  pc 0x000000010832fcbc fp 0x000000016dfb65a0 sp 0x000000016dfb6568 [Unoptimized] _microtaskLoop@5048458
  pc 0x000000010832f820 fp 0x000000016dfb65e0 sp 0x000000016dfb65b0 [Unoptimized] _startMicrotaskLoop@5048458
  pc 0x000000010832f708 fp 0x000000016dfb6608 sp 0x000000016dfb65f0 [Unoptimized] _startMicrotaskLoop@5048458
  pc 0x000000010832d778 fp 0x000000016dfb6648 sp 0x000000016dfb6618 [Unoptimized] _runPendingImmediateCallback@1026248
  pc 0x0000000108325e6c fp 0x000000016dfb6688 sp 0x000000016dfb6658 [Unoptimized] _RawReceivePort@1026248._handleMessage@1026248
  pc 0x0000000105003a84 fp 0x000000016dfb6760 sp 0x000000016dfb6698 [Stub] InvokeDartCode
Abort trap: 6

Before script:

class C {
  static foo() => 'old';
}

var f1 = C.foo;
h() {
}

void main() => print(h());

After script:

class C {
  static foo(i) => '$i';
}

var f1;
h() {
  f1();
}

void main() => print(h());

Discovered on the hot reload suite trying to replicate:

TEST_CASE(IsolateReload_TearOff_Parameter_Count_Mismatch) {

Also reproducible via pkg/dev_compiler/tool/hotreload/hot_reload_helper.dart

Metadata

Metadata

Labels

area-vmUse area-vm for VM related issues, including code coverage, and the AOT and JIT backends.crashProcess exits with SIGSEGV, SIGABRT, etc. An unhandled exception is not a crash.triagedIssue has been triaged by sub teamtype-bugIncorrect behavior (everything from a crash to more subtle misbehavior)vm-hot-reload

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions