Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

flag_fuzzer managed to produce unexpected output #59728

Closed
derekxu16 opened this issue Dec 16, 2024 · 1 comment
Closed

flag_fuzzer managed to produce unexpected output #59728

derekxu16 opened this issue Dec 16, 2024 · 1 comment
Labels
area-vm Use area-vm for VM related issues, including code coverage, and the AOT and JIT backends. dartfuzz Found with Dart fuzzing (DartFuzz, libFuzzer, etc.) gardening

Comments

@derekxu16
Copy link
Member

https://logs.chromium.org/logs/dart/buildbucket/cr-buildbucket/8728425132939576785/+/u/collect_shards/dartfuzz_-_flags_shard_45/task_stdout_stderr:_dartfuzz_-_flags_shard_45

=== FAILURE ===
command: out/ReleaseX64C/dart --profiler --max_profile_depth=252 --runtime_allocate_spill_tlab --force_clone_compiler_objects --inlining_depth_threshold=6 --inlining_callee_call_sites_threshold=2 pkg/compiler/lib/src/dart2js.dart --invoker=test --platform-binaries=out/ReleaseX64 --out=out/dartfuzz/4.js --no-source-maps pkg/compiler/lib/src/util/memory_compiler.dart
command: diff out/dartfuzz/expected.js out/dartfuzz/4.js
exitCode: 1
stdout:
319807c319807
<       var t1, t2, variable, matchedType, t3, expression, expressionType, equalsTargetReference, typeArgument, patterns, requiredType, matchedValueType, flags, lookupType, lengthTargetReference, lengthType, lengthCheckTargetReference, sublistTargetReference, sublistType, minusTargetReference, minusType, indexGetTargetReference, indexGetType, keyType, valueType, entries, containsKeyTargetReference, $name, pattern, fieldName, accessKind, targetReference, resultType, recordFieldIndex, typeArguments, t4, type, fields, objectType, recordType, kind, _this = this, _null = null,
---
>       var t1, t2, variable, matchedType, t3, expression, expressionType, equalsTargetReference, typeArgument, patterns, requiredType, matchedValueType, flags, lookupType, lengthTargetReference, lengthType, lengthCheckTargetReference, sublistTargetReference, sublistType, minusTargetReference, minusType, indexGetTargetReference, indexGetType, keyType, valueType, entries, containsKeyTargetReference, type, fields, objectType, t4, recordType, kind, accessKind, $name, targetReference, typeArguments, _this = this, _null = null,
319913,319943c319913
<           t1 = _this.readUInt30$0();
<           t2 = _this._stringTable;
<           t3 = _this.readUInt30$0();
<           if (!(t3 < t2.length))
<             return A.ioore(t2, t3);
<           $name = t2[t3];
<           pattern = _this._readPattern$0();
<           fieldName = _this.readName$0();
<           t3 = _this.readByte$0();
<           if (!(t3 < 12))
<             return A.ioore(B.List_DET, t3);
<           accessKind = B.List_DET[t3];
<           targetReference = _this.readNullableMemberReference$0();
<           resultType = _this.readAndCheckOptionTag$0() ? _this.readDartType$0() : _null;
<           t2 = _this.readAndCheckOptionTag$0() ? _this.readDartType$0() : _null;
<           type$.nullable_RecordType._as(t2);
<           recordFieldIndex = _this.readUInt30$0();
<           t3 = _this.readAndCheckOptionTag$0() ? _this.readDartType$0() : _null;
<           type$.nullable_FunctionType_2._as(t3);
<           typeArguments = _this.readAndCheckOptionTag$0() ? _this.readDartTypeList$0() : _null;
<           t4 = A.NamedPattern$($name, pattern);
<           t4.fieldName = fieldName;
<           t4.accessKind = accessKind;
<           t4.targetReference = targetReference;
<           t4.resultType = resultType;
<           t4.recordType = t2;
<           t4.recordFieldIndex = recordFieldIndex;
<           t4.functionType = t3;
<           t4.set$typeArguments(typeArguments);
<           t4.fileOffset = t1 - 1;
<           return t4;
---
>           return _this._readNamedPattern$0();
320065a320036,320069
>     },
>     _readNamedPattern$0() {
>       var $name, pattern, fieldName, accessKind, targetReference, resultType, recordFieldIndex, typeArguments, t4, _this = this, _null = null,
>         t1 = _this.readUInt30$0(),
>         t2 = _this._stringTable,
>         t3 = _this.readUInt30$0();
>       if (!(t3 < t2.length))
>         return A.ioore(t2, t3);
>       $name = t2[t3];
>       pattern = _this._readPattern$0();
>       fieldName = _this.readName$0();
>       t3 = _this.readByte$0();
>       if (!(t3 < 12))
>         return A.ioore(B.List_DET, t3);
>       accessKind = B.List_DET[t3];
>       targetReference = _this.readNullableMemberReference$0();
>       resultType = _this.readAndCheckOptionTag$0() ? _this.readDartType$0() : _null;
>       t2 = _this.readAndCheckOptionTag$0() ? _this.readDartType$0() : _null;
>       type$.nullable_RecordType._as(t2);
>       recordFieldIndex = _this.readUInt30$0();
>       t3 = _this.readAndCheckOptionTag$0() ? _this.readDartType$0() : _null;
>       type$.nullable_FunctionType_2._as(t3);
>       typeArguments = _this.readAndCheckOptionTag$0() ? _this.readDartTypeList$0() : _null;
>       t4 = A.NamedPattern$($name, pattern);
>       t4.fieldName = fieldName;
>       t4.accessKind = accessKind;
>       t4.targetReference = targetReference;
>       t4.resultType = resultType;
>       t4.recordType = t2;
>       t4.recordFieldIndex = recordFieldIndex;
>       t4.functionType = t3;
>       t4.set$typeArguments(typeArguments);
>       t4.fileOffset = t1 - 1;
>       return t4;
@derekxu16 derekxu16 added area-vm Use area-vm for VM related issues, including code coverage, and the AOT and JIT backends. gardening dartfuzz Found with Dart fuzzing (DartFuzz, libFuzzer, etc.) labels Dec 16, 2024
@a-siva
Copy link
Contributor

a-siva commented Dec 18, 2024

This does not reproduce when tried on the latest main build, closing issue.

@a-siva a-siva closed this as completed Dec 18, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area-vm Use area-vm for VM related issues, including code coverage, and the AOT and JIT backends. dartfuzz Found with Dart fuzzing (DartFuzz, libFuzzer, etc.) gardening
Projects
None yet
Development

No branches or pull requests

2 participants