Skip to content

dartfuzz failure: tagged_pointer.h: 103: error: expected: IsWellFormed() #59844

@bkonyi

Description

@bkonyi

We've encountered the following assertion on a couple of architectures (DebugIA32, DebugSIMARM64):

../../runtime/vm/tagged_pointer.h: 103: error: expected: IsWellFormed()

Sample output:

Isolate (/b/s/w/itbri9eldb/dart_fuzzDAOCIS) NO-FP NO-FFI FLAT : JIT-DebugSIMARM - JIT-DEPOPTEVERY-134-DET-DebugIA32: !DIVERGENCE! 1.101:417449394 (0 vs -6)

fail2:
-6

// ...
// Stripped stdout
// ...

../../runtime/vm/tagged_pointer.h: 103: error: expected: IsWellFormed()
version=3.7.0-edge (main) (Unknown timestamp) on "linux_ia32"
pid=21370, thread=21448, isolate_group=main(0x5a8f51d0), isolate=main(0x5a8f94b0)
os=linux, arch=ia32, comp=no, sim=no
isolate_instructions=589bab20, vm_instructions=589bab20
fp=f18fe048, sp=f18fdfb8, pc=59105aab
  pc 0x59105aab fp 0xf18fe048 dart::Profiler::DumpStackTrace+0x9b
  pc 0x594a6ed1 fp 0xf18fe068 Dart_DumpNativeStackTrace+0x21
  pc 0x589bad16 fp 0xf18fe098 dart::Assert::Fail+0x36
  pc 0x58e4a992 fp 0xf18fe0d8 dart::Object::initializeHandle+0xb2
  pc 0x58f5f5ea fp 0xf18fe1c8 dart::ExceptionHandlerFinder::ExecuteCatchEntryMoves+0x3aa
  pc 0x58f5ece9 fp 0xf18fe208 dart::ExceptionHandlerFinder::PrepareFrameForCatchEntry+0x49
  pc 0x58f5d242 fp 0xf18fe2f8 dart::ThrowExceptionHelper+0x612
  pc 0x58f5d40e fp 0xf18fe328 dart::Exceptions::ReThrow+0x2e
  pc 0x59138202 fp 0xf18fe758 dart::DRT_ReThrow+0x262
  pc 0xf7582401 fp 0xf18fe774 Unknown symbol
  pc 0xf7586fc2 fp 0xf18fe790 Unknown symbol
  pc 0xf6add7cf fp 0xf18fe834 Unknown symbol
  pc 0xf6acd920 fp 0xf18fe88c Unknown symbol
  pc 0xf6acd920 fp 0xf18fe8e4 Unknown symbol
  pc 0xf6acd920 fp 0xf18fe93c Unknown symbol
  pc 0xf6acd920 fp 0xf18fe994 Unknown symbol
  pc 0xf6aa099f fp 0xf18fe9c8 Unknown symbol
  pc 0xf6a9dac5 fp 0xf18fe9d8 Unknown symbol
  pc 0xf6a9d9f7 fp 0xf18fea04 Unknown symbol
  pc 0xf6a9c7a5 fp 0xf18fea20 Unknown symbol
  pc 0xf6a9c3bb fp 0xf18fea50 Unknown symbol
  pc 0xf6a9b102 fp 0xf18fea78 Unknown symbol
  pc 0xf758279a fp 0xf18feaa8 Unknown symbol
  pc 0x58f35c36 fp 0xf18feb08 dart::DartEntry::InvokeFunction+0x166
  pc 0x58f35a78 fp 0xf18feb48 dart::DartEntry::InvokeFunction+0x88
  pc 0x58f3874f fp 0xf18feba8 dart::DartLibraryCalls::HandleMessage+0x10f
  pc 0x58f737b0 fp 0xf18ff018 dart::IsolateMessageHandler::HandleMessage+0x430
  pc 0x58fb5340 fp 0xf18ff098 dart::MessageHandler::HandleMessages+0x220
  pc 0x58fb5fff fp 0xf18ff0f8 dart::MessageHandler::TaskCallback+0x2ef
  pc 0x58fb6f09 fp 0xf18ff138 dart::MessageHandlerTask::Run+0x29
  pc 0x591974b8 fp 0xf18ff1a8 dart::ThreadPool::WorkerLoop+0x198
  pc 0x59197da0 fp 0xf18ff1f8 dart::ThreadPool::Worker::Main+0x150
  pc 0x590fef3b fp 0xf18ff358 dart::ThreadStart+0x11b
  pc 0xf7ef9635 fp 0xf18ff428 /lib/i386-linux-gnu/libpthread.so.0+0x7635
-- End of DumpStackTrace
  pc 0x00000000 fp 0xf18fe774 sp 0x00000000 [Stub] CallToRuntime
  pc 0xf7586fc2 fp 0xf18fe790 sp 0xf18fe77c [Stub] ReThrow
  pc 0xf6add7cf fp 0xf18fe834 sp 0xf18fe798 [Optimized] X1.foo1_0
  pc 0xf6acd920 fp 0xf18fe88c sp 0xf18fe83c [Unoptimized] X1.foo1_0
  pc 0xf6acd920 fp 0xf18fe8e4 sp 0xf18fe894 [Unoptimized] X1.foo1_0
  pc 0xf6acd920 fp 0xf18fe93c sp 0xf18fe8ec [Unoptimized] X1.foo1_0
  pc 0xf6acd920 fp 0xf18fe994 sp 0xf18fe944 [Unoptimized] X1.foo1_0
  pc 0xf6aa099f fp 0xf18fe9c8 sp 0xf18fe99c [Unoptimized] main
  pc 0xf6a9dac5 fp 0xf18fe9d8 sp 0xf18fe9d0 [Unoptimized] main
  pc 0xf6a9d9f7 fp 0xf18fea04 sp 0xf18fe9e0 [Unoptimized] _Closure@0150898.dyn:call
  pc 0xf6a9c7a5 fp 0xf18fea20 sp 0xf18fea0c [Unoptimized] _delayEntrypointInvocation@1026248.<anonymous closure>
  pc 0xf6a9c3bb fp 0xf18fea50 sp 0xf18fea28 [Unoptimized] _Closure@0150898.dyn:call
  pc 0xf6a9b102 fp 0xf18fea78 sp 0xf18fea58 [Unoptimized] _RawReceivePort@1026248._handleMessage@1026248
  pc 0xf758279a fp 0xf18feaa8 sp 0xf18fea80 [Stub] InvokeDartCode



-- BEGIN REPRODUCE  --

DART SDK REVISION: 

**dart runtime/tools/dartfuzz/dartfuzz.dart --no-fp --no-ffi --flat --seed 417449394 fuzz.dart**

-- RUN 1 --

out/DebugSIMARM/dart --old_gen_heap_size=128 /b/s/w/itbri9eldb/dart_fuzzDAOCIS/fuzz.dart

-- RUN 2 --

**out/DebugIA32/dart --deoptimize_every=134 --deterministic --old_gen_heap_size=128 /b/s/w/itbri9eldb/dart_fuzzDAOCIS/fuzz.dart**

-- END REPRODUCE  --

FYI @alexmarkov @rmacnak-google

Metadata

Metadata

Assignees

No one assigned

    Labels

    P2A bug or feature request we're likely to work onarea-vmUse area-vm for VM related issues, including code coverage, and the AOT and JIT backends.dartfuzzFound with Dart fuzzing (DartFuzz, libFuzzer, etc.)gardeningtriagedIssue has been triaged by sub team

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions