[Webkit-unassigned] [Bug 236037] Wasm crash on https://copy.sh/v86/?profile=dsl

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=236037

--- Comment #8 from Yusuke Suzuki <ysuzuki at apple.com> ---
(In reply to Saam Barati from comment #7)
> seems like we need to be running with webAssemblyOMGOptimizationLevel=2 for
> this to reproduce. It also doesn't seem to be a bug in IRC, since running
> with O1 and forcing on IRC does not crash either

Nice! In that case, typically I comment out several path in B3Generate.cpp to see which pass can trigger this problem :)

   84     if (procedure.optLevel() >= 2) {
   85         reduceDoubleToFloat(procedure);
   86         reduceStrength(procedure);
   87         // FIXME: Re-enable B3 hoistLoopInvariantValues
   88         // https://bugs.webkit.org/show_bug.cgi?id=212651
   89         if (Options::useB3HoistLoopInvariantValues())
   90             hoistLoopInvariantValues(procedure);
   91         if (eliminateCommonSubexpressions(procedure))
   92             eliminateCommonSubexpressions(procedure);
   93         eliminateDeadCode(procedure);
   94         inferSwitches(procedure);
   95         reduceLoopStrength(procedure);
   96         if (Options::useB3TailDup())
   97             duplicateTails(procedure);
   98         fixSSA(procedure);
   99         foldPathConstants(procedure);
  100         // FIXME: Add more optimizations here.
  101         // https://bugs.webkit.org/show_bug.cgi?id=150507

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20220205/b5cd3b08/attachment.htm>