[Webkit-unassigned] [Bug 236037] Wasm crash on https://copy.sh/v86/?profile=dsl

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=236037

--- Comment #9 from Saam Barati <sbarati at apple.com> ---
(In reply to Yusuke Suzuki from comment #8)
> (In reply to Saam Barati from comment #7)
> > seems like we need to be running with webAssemblyOMGOptimizationLevel=2 for
> > this to reproduce. It also doesn't seem to be a bug in IRC, since running
> > with O1 and forcing on IRC does not crash either
> 
> Nice! In that case, typically I comment out several path in B3Generate.cpp
> to see which pass can trigger this problem :)
> 
>    84     if (procedure.optLevel() >= 2) {
>    85         reduceDoubleToFloat(procedure);
>    86         reduceStrength(procedure);
>    87         // FIXME: Re-enable B3 hoistLoopInvariantValues
>    88         // https://bugs.webkit.org/show_bug.cgi?id=212651
>    89         if (Options::useB3HoistLoopInvariantValues())
>    90             hoistLoopInvariantValues(procedure);
>    91         if (eliminateCommonSubexpressions(procedure))
>    92             eliminateCommonSubexpressions(procedure);
>    93         eliminateDeadCode(procedure);
>    94         inferSwitches(procedure);
>    95         reduceLoopStrength(procedure);
>    96         if (Options::useB3TailDup())
>    97             duplicateTails(procedure);
>    98         fixSSA(procedure);
>    99         foldPathConstants(procedure);
>   100         // FIXME: Add more optimizations here.
>   101         // https://bugs.webkit.org/show_bug.cgi?id=150507

Yeah, I've been doing this. No luck so far. Though commenting out some stuff seems to change how frequently the crash reproduces.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20220207/a26313cf/attachment-0001.htm>