Crash in typescript using nodejs 16 on ppcle

[Flarna]

• Version: 16.0.0
• Platform: Linux ls-ub-lf40a2dv 4.4.0-200-generic doc: update AUTHORS file, add tool for doing it #232-Ubuntu SMP Wed Jan 13 10:17:10 UTC 2021 ppc64le ppc64le ppc64le GNU/Linux
• Subsystem: @nodejs/v8

What steps will reproduce the bug?

building a project (unfortunately closed source) using typescript 4.2.4

Update: Seems to happen with other projects, e.g. building typescript itself

How often does it reproduce? Is there a required condition?

always, no special condition besides using PPCLE (no problem on windows, linux x86, linux arm).

What is the expected behavior?

building works also on PPCLE

What do you see instead?

/home/labuser/repo/node/proj/node_modules/typescript/lib/tsc.js:88057
                throw e;
                ^

TypeError: nodes.slice is not a function
    at visitNodes (/home/labuser/repo/node/proj/node_modules/typescript/lib/tsc.js:68214:37)
    at Object.visitEachChild (/home/labuser/repo/node/proj/node_modules/typescript/lib/tsc.js:68448:58)
    at visitTypeScript (/home/labuser/repo/node/proj/node_modules/typescript/lib/tsc.js:70186:31)
    at visitorWorker (/home/labuser/repo/node/proj/node_modules/typescript/lib/tsc.js:69997:24)
    at saveStateAndInvoke (/home/labuser/repo/node/proj/node_modules/typescript/lib/tsc.js:69956:27)
    at visitor (/home/labuser/repo/node/proj/node_modules/typescript/lib/tsc.js:69993:20)
    at visitNode (/home/labuser/repo/node/proj/node_modules/typescript/lib/tsc.js:68172:23)
    at Object.visitFunctionBody (/home/labuser/repo/node/proj/node_modules/typescript/lib/tsc.js:68309:23)
    at visitMethodDeclaration (/home/labuser/repo/node/proj/node_modules/typescript/lib/tsc.js:70932:292)
    at visitTypeScript (/home/labuser/repo/node/proj/node_modules/typescript/lib/tsc.js:70145:28)
    at visitorWorker (/home/labuser/repo/node/proj/node_modules/typescript/lib/tsc.js:69997:24)
    at classElementVisitorWorker (/home/labuser/repo/node/proj/node_modules/typescript/lib/tsc.js:70065:28)

Additional information

If I attach the debugger problem is gone.
If I add typeof(node.slice) (which should be a not in my opinion) just before the line causing the TypeError it no longer occurs but a similar TypeError happens at another place.
If I add also typeof() checks at the next two such locations I finally end up in a segmentation fault with a quite small callstack:

#0  0x00000000115dd9b4 in Builtins_LoadIC_Megamorphic ()
#1  0x00000e8ec1d600e0 in ?? ()

[targos]

/cc @nodejs/platform-ppc

[mhdawson]

@miladfarca are there some options you could recommend to disable V8 optimizations to see if it might be related to code being generated?

[miladfarca]

--jitless can be used to avoid generating code: i.e:

node --jitless npm ...

will look into the details on why it is segfaulting on ppc.

[Flarna]

I can confirm that --jitless avoids the crash.

[miladfarca]

@Flarna Thanks for confirming. Would you also be able to use the v16.0.0 node binary from this nightly build and check if the problem still exists? (without using --jitless)

https://nodejs.org/download/nightly/v16.0.0-nightly202102126ea9af9906/

PPC file will be: https://nodejs.org/download/nightly/v16.0.0-nightly202102126ea9af9906/node-v16.0.0-nightly202102126ea9af9906-linux-ppc64le.tar.gz

[Flarna]

@miladfarca This version looks good.

Tried also the next newer version v16.0.0-nightly2021021388d9268d08 => this one shows the problem

[john-yan]

Debug build is not able to compile at the moment. I submitted another PR at #38571 so this might take longer. @targos Would you be able to help on the gyp/GN scraper issue?

[gyakovlev]

can confirm segfault while building qtwebengine/chromium typescript parts on ppc64le with 16.1.0

[gyakovlev]

I can't reproduce with debug build of node (with #38571 applied)

[gyakovlev]

ok I've tried building with -O0 (default for debug unoptimized build), -Og , and -O2 for BUILDTYPE=Debug it does SIGTRAP

Core was generated by `/usr/bin/node ../../../../qtwebengine-5.15.2_p20210421/src/3rdparty/chromium/th'.
Program terminated with signal SIGTRAP, Trace/breakpoint trap.
#0  0x00000001042114ac in v8::base::OS::Abort () at ../deps/v8/src/base/platform/platform-posix.cc:502
502         V8_IMMEDIATE_CRASH();
[Current thread is 1 (Thread 0x7fffa1b99010 (LWP 8434))]
(gdb) bt
#0  0x00000001042114ac in v8::base::OS::Abort () at ../deps/v8/src/base/platform/platform-posix.cc:502
#1  0x00000001062d62a0 in V8_Fatal (file=0x106b6ce60 "../deps/v8/src/deoptimizer/deoptimizer.cc", line=<optimized out>,
    format=format@entry=0x1089dccd0 "Debug check failed: %s.") at ../deps/v8/src/base/logging.cc:167
#2  0x00000001062d62e0 in v8::base::(anonymous namespace)::DefaultDcheckHandler (file=<optimized out>, line=<optimized out>,
    message=<optimized out>) at ../deps/v8/src/base/logging.cc:57
#3  0x00000001062d6328 in V8_Dcheck (file=<optimized out>, line=<optimized out>, message=<optimized out>)
    at ../deps/v8/src/base/logging.cc:180
#4  0x00000001048916a4 in v8::internal::Deoptimizer::Deoptimizer (this=0x141d1c380, isolate=<optimized out>, function=...,
    kind=<optimized out>, deopt_exit_index=<optimized out>, from=<optimized out>, fp_to_sp_delta=<optimized out>)
    at ../deps/v8/src/deoptimizer/deoptimizer.cc:574
#5  0x0000000104891964 in v8::internal::Deoptimizer::New (raw_function=<optimized out>, kind=<optimized out>,
    deopt_exit_index=<optimized out>, from=69196732299540, fp_to_sp_delta=<optimized out>, isolate=0x141c6fb40)
    at ../deps/v8/src/deoptimizer/deoptimizer.cc:195
#6  0x000000010563b238 in Builtins_DeoptimizationEntry_Soft () at ../deps/v8/src/builtins/builtins-internal-gen.cc:1107






(gdb) bt full
#0  0x00000001042114ac in v8::base::OS::Abort () at ../deps/v8/src/base/platform/platform-posix.cc:502
No locals.
#1  0x00000001062d62a0 in V8_Fatal (file=0x106b6ce60 "../deps/v8/src/deoptimizer/deoptimizer.cc", line=<optimized out>, format=format@entry=0x1089dccd0 "Debug check failed: %s.") at ../deps/v8/src/base/logging.cc:167
        arguments = 0x7fffcbeb1308 "\200)4B\001"
        message = {static kStartMarker = <optimized out>, static kEndMarker = <optimized out>, static kMessageBufferSize = <optimized out>, start_marker_ = 3737837072, message_ = "Debug check failed: 0 == offset % kNonLazyDeoptExitSize (0 vs. 8).", '\000' <repeats 445 times>,
          end_marker_ = 3737837073}
#2  0x00000001062d62e0 in v8::base::(anonymous namespace)::DefaultDcheckHandler (file=<optimized out>, line=<optimized out>, message=<optimized out>) at ../deps/v8/src/base/logging.cc:57
No locals.
#3  0x00000001062d6328 in V8_Dcheck (file=<optimized out>, line=<optimized out>, message=<optimized out>) at ../deps/v8/src/base/logging.cc:180
No locals.
#4  0x00000001048916a4 in v8::internal::Deoptimizer::Deoptimizer (this=0x141d1c380, isolate=<optimized out>, function=..., kind=<optimized out>, deopt_exit_index=<optimized out>, from=<optimized out>, fp_to_sp_delta=<optimized out>)
    at ../deps/v8/src/deoptimizer/deoptimizer.cc:574
        _msg = 0x142351f00
        offset = <optimized out>
        deopt_start = <optimized out>
        lazy_deopt_start = 69196732299592
        eager_with_resume_deopt_start = <optimized out>
        deopt_data = {<v8::internal::FixedArray> = {<v8::internal::TorqueGeneratedFixedArray<v8::internal::FixedArray, v8::internal::FixedArrayBase>> = {<v8::internal::FixedArrayBase> = {<v8::internal::TorqueGeneratedFixedArrayBase<v8::internal::FixedArrayBase, v8::internal::HeapObject>> = {<v8::internal::HeapObject> = {<v8::internal::Object> = {<v8::internal::TaggedImpl<(v8::internal::HeapObjectReferenceType)1, unsigned long>> = {static kIsFull = <optimized out>, static kCanBeWeak = false, ptr_ = 35165796512481},
                      static kHeaderSize = 0}, <No data fields>}, static kStartOfStrongFieldsOffset = <optimized out>, static kLengthOffset = 8, static kLengthOffsetEnd = 15, static kEndOfStrongFieldsOffset = <optimized out>, static kStartOfWeakFieldsOffset = <optimized out>,
                  static kEndOfWeakFieldsOffset = <optimized out>, static kHeaderSize = 16}, static kMaxSize = 1073741816}, static kStartOfStrongFieldsOffset = <optimized out>, static kHeaderSize = 16, static kObjectsOffset = <optimized out>,
              static kObjectsOffsetEnd = <optimized out>, static kEndOfStrongFieldsOffset = <optimized out>, static kStartOfWeakFieldsOffset = <optimized out>, static kEndOfWeakFieldsOffset = <optimized out>}, static kMaxLength = 134217725, static kMaxRegularLength = 32766,
            static kObjectsOffset = 16}, static kTranslationByteArrayIndex = 0, static kInlinedFunctionCountIndex = 1, static kLiteralArrayIndex = 2, static kOsrBytecodeOffsetIndex = 3, static kOsrPcOffsetIndex = 4, static kOptimizationIdIndex = 5,
          static kSharedFunctionInfoIndex = 6, static kInliningPositionsIndex = 7, static kDeoptExitStartIndex = 8, static kEagerSoftAndBailoutDeoptCountIndex = 9, static kLazyDeoptCountIndex = 10, static kFirstDeoptEntryIndex = 11, static kBytecodeOffsetRawOffset = 0,
          static kTranslationIndexOffset = 1, static kPcOffset = 2, static kDeoptEntrySize = 3, static kNotInlinedIndex = -1}
        eager_soft_and_bailout_deopt_count = 253
        lazy_deopt_count = <optimized out>
        size = <optimized out>
        parameter_count = <optimized out>
        size = <optimized out>
        parameter_count = <optimized out>
        _msg = <optimized out>
        scope = {static kCheckHandleThreshold = 30720, isolate_ = <optimized out>, prev_next_ = <optimized out>, prev_limit_ = <optimized out>}
        deopt_data = {<v8::internal::FixedArray> = {<v8::internal::TorqueGeneratedFixedArray<v8::internal::FixedArray, v8::internal::FixedArrayBase>> = {<v8::internal::FixedArrayBase> = {<v8::internal::TorqueGeneratedFixedArrayBase<v8::internal::FixedArrayBase, v8::internal::HeapObject>> = {<v8::internal::HeapObject> = {<v8::internal::Object> = {<v8::internal::TaggedImpl<(v8::internal::HeapObjectReferenceType)1, unsigned long>> = {static kIsFull = <optimized out>, static kCanBeWeak = false, ptr_ = <optimized out>},
                      static kHeaderSize = 0}, <No data fields>}, static kStartOfStrongFieldsOffset = <optimized out>, static kLengthOffset = 8, static kLengthOffsetEnd = 15, static kEndOfStrongFieldsOffset = <optimized out>, static kStartOfWeakFieldsOffset = <optimized out>,
                  static kEndOfWeakFieldsOffset = <optimized out>, static kHeaderSize = 16}, static kMaxSize = 1073741816}, static kStartOfStrongFieldsOffset = <optimized out>, static kHeaderSize = 16, static kObjectsOffset = <optimized out>,
              static kObjectsOffsetEnd = <optimized out>, static kEndOfStrongFieldsOffset = <optimized out>, static kStartOfWeakFieldsOffset = <optimized out>, static kEndOfWeakFieldsOffset = <optimized out>}, static kMaxLength = 134217725, static kMaxRegularLength = 32766,
            static kObjectsOffset = 16}, static kTranslationByteArrayIndex = 0, static kInlinedFunctionCountIndex = 1, static kLiteralArrayIndex = 2, static kOsrBytecodeOffsetIndex = 3, static kOsrPcOffsetIndex = 4, static kOptimizationIdIndex = 5,
          static kSharedFunctionInfoIndex = 6, static kInliningPositionsIndex = 7, static kDeoptExitStartIndex = 8, static kEagerSoftAndBailoutDeoptCountIndex = 9, static kLazyDeoptCountIndex = 10, static kFirstDeoptEntryIndex = 11, static kBytecodeOffsetRawOffset = 0,
          static kTranslationIndexOffset = 1, static kPcOffset = 2, static kDeoptEntrySize = 3, static kNotInlinedIndex = -1}
        deopt_start = <optimized out>
        eager_soft_and_bailout_deopt_count = <optimized out>
        lazy_deopt_start = <optimized out>
        lazy_deopt_count = <optimized out>
        eager_with_resume_deopt_start = <optimized out>
        _msg = <optimized out>
        _msg = <optimized out>
        _msg = <optimized out>
        offset = <optimized out>
        _msg = <optimized out>
        offset = <optimized out>
--Type <RET> for more, q to quit, c to continue without paging--
        _msg = <optimized out>
        offset = <optimized out>
        _msg = <optimized out>
#5  0x0000000104891964 in v8::internal::Deoptimizer::New (raw_function=<optimized out>, kind=<optimized out>, deopt_exit_index=<optimized out>, from=69196732299540, fp_to_sp_delta=<optimized out>, isolate=0x141c6fb40) at ../deps/v8/src/deoptimizer/deoptimizer.cc:195
        function = {<v8::internal::JSFunctionOrBoundFunction> = {<v8::internal::TorqueGeneratedJSFunctionOrBoundFunction<v8::internal::JSFunctionOrBoundFunction, v8::internal::JSObject>> = {<v8::internal::JSObject> = {<v8::internal::TorqueGeneratedJSObject<v8::internal::JSObject, v8::internal::JSReceiver>> = {<v8::internal::JSReceiver> = {<v8::internal::HeapObject> = {<v8::internal::Object> = {<v8::internal::TaggedImpl<(v8::internal::HeapObjectReferenceType)1, unsigned long>> = {static kIsFull = <optimized out>, static kCanBeWeak = false,
                          ptr_ = 2082690347097}, static kHeaderSize = 0}, <No data fields>}, static kHashMask = 2147482624}, static kStartOfStrongFieldsOffset = v8::internal::JSReceiver::kStartOfStrongFieldsOffset, static kElementsOffset = 16, static kElementsOffsetEnd = 23,
                  static kEndOfStrongFieldsOffset = v8::internal::JSReceiver::kEndOfStrongFieldsOffset, static kStartOfWeakFieldsOffset = v8::internal::JSReceiver::kEndOfStrongFieldsOffset, static kEndOfWeakFieldsOffset = v8::internal::JSReceiver::kEndOfStrongFieldsOffset,
                  static kHeaderSize = 24}, static kMinAddedElementsCapacity = 16, static kMaxElementCount = 4294967295, static kMaxGap = 1024, static kMaxUncheckedFastElementsLength = 5000, static kMaxUncheckedOldFastElementsLength = 500,
                static kInitialGlobalObjectUnusedPropertiesCount = 4, static kMaxInstanceSize = 2040, static kFieldsAdded = 3, static kMaxInObjectProperties = 252, static kMaxFirstInobjectPropertyOffset = 127, static kMaxEmbedderFields = 12},
              static kStartOfWeakFieldsOffset = v8::internal::JSReceiver::kEndOfStrongFieldsOffset, static kEndOfWeakFieldsOffset = v8::internal::JSReceiver::kEndOfStrongFieldsOffset, static kStartOfStrongFieldsOffset = v8::internal::JSReceiver::kStartOfStrongFieldsOffset,
              static kEndOfStrongFieldsOffset = v8::internal::JSReceiver::kEndOfStrongFieldsOffset, static kHeaderSize = 24}, <No data fields>}, static kLengthDescriptorIndex = 0, static kNameDescriptorIndex = 1, static kMinDescriptorsForFastBind = 2,
          static kSharedFunctionInfoOffset = 24, static kContextOffset = 32, static kFeedbackCellOffset = 40, static kCodeOffset = 48, static kPrototypeOrInitialMapOffset = 56, static kHeaderSize = 24, static kSizeWithoutPrototype = 56, static kSizeWithPrototype = 64}
        deoptimizer = <optimized out>
#6  0x000000010563b238 in Builtins_DeoptimizationEntry_Soft () at ../deps/v8/src/builtins/builtins-internal-gen.cc:1107
No locals.

so far here's the backtrace for Release build with flags overriden to -O2 -ggdb -fno-omit-frame-pointer

Core was generated by `/usr/bin/node ../../../../qtwebengine-5.15.2_p20210421/src/3rdparty/chromium/th'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000000013bb29178 in v8::internal::Object::ReadField<unsigned char, 0> (offset=1612733462, this=0x7fffcc053e28)
    at ../deps/v8/src/objects/objects.h:649
649     ../deps/v8/src/objects/objects.h: No such file or directory.
[Current thread is 1 (Thread 0x7fff80089010 (LWP 7124))]
(gdb) bt
#0  0x000000013bb29178 in v8::internal::Object::ReadField<unsigned char, 0> (offset=1612733462, this=0x7fffcc053e28)
    at ../deps/v8/src/objects/objects.h:649
#1  v8::internal::ByteArray::get (index=1612733447, this=0x7fffcc053e28) at ../deps/v8/src/objects/fixed-array-inl.h:554
#2  v8::internal::TranslationArrayIterator::Next (this=0x7fffcc053e10) at ../deps/v8/src/deoptimizer/translation-array.cc:64
#3  0x000000013bb287b4 in v8::internal::TranslatedState::Init (this=0x143257900, isolate=<optimized out>,
    input_frame_pointer=<optimized out>, stack_frame_pointer=<optimized out>, iterator=<optimized out>, literal_array=...,
    registers=<optimized out>, trace_file=<optimized out>, formal_parameter_count=3, actual_argument_count=3)
    at ../deps/v8/src/deoptimizer/translated-state.cc:1315
#4  0x000000013bb1d9b8 in v8::internal::Deoptimizer::DoComputeOutputFrames (this=0x143257880)
    at ../deps/v8/src/deoptimizer/deoptimizer.cc:889
#5  0x000000013c44b8bc in Builtins_DeoptimizationEntry_Lazy ()








(gdb) bt full
#0  0x000000013bb29178 in v8::internal::Object::ReadField<unsigned char, 0> (offset=1612733462, this=0x7fffcc053e28)
    at ../deps/v8/src/objects/objects.h:649
        v8_pointer_compression_unaligned = false
        v8_pointer_compression_unaligned = <optimized out>
#1  v8::internal::ByteArray::get (index=1612733447, this=0x7fffcc053e28) at ../deps/v8/src/objects/fixed-array-inl.h:554
No locals.
#2  v8::internal::TranslationArrayIterator::Next (this=0x7fffcc053e10) at ../deps/v8/src/deoptimizer/translation-array.cc:64
        next = <optimized out>
        i = 0
        bits = 0
        is_negative = <optimized out>
        result = <optimized out>
#3  0x000000013bb287b4 in v8::internal::TranslatedState::Init (this=0x143257900, isolate=<optimized out>,
    input_frame_pointer=<optimized out>, stack_frame_pointer=<optimized out>, iterator=<optimized out>, literal_array=...,
    registers=<optimized out>, trace_file=<optimized out>, formal_parameter_count=3, actual_argument_count=3)
    at ../deps/v8/src/deoptimizer/translated-state.cc:1315
        opcode = <optimized out>
        count = <optimized out>
        update_feedback_count = <optimized out>
        nested_counts = std::stack wrapping: std::deque with 800736050 elements = {-872071344, 32767, -1877716216, 16018, 1652552377,
          9632, -710525751, 9713, -872071416, 32767, 1126529152, 1, -452450919, 6541, -710525751, 9713, -872071240, 32767, -219972639,
          4549, 1, 0, -219960135, 4549, -219972639, 4549, -1877792416, 16018, -872071232, 32767, -1877794572, 16018, -452450919, 6541,
          -710525751, 9713, -1877682752, 16018, -872071224, 32767, -1877685556, 16018, -219972639, 4549, -710812119, 9713, -452450455,
          6541, 2, 0, -219953863, 4549, -219972639, 4549, -1877671960, 16018, -872071136, 32767, -1877673056, 16018, -452450919, 6541,
          -710525751, 9713, 0, 0, 0, 0, -219972639, 4549, -219953863, 4549, 1, 0, -219960263, 4549, -219972639, 4549, -1877689560, 16018,
--Type <RET> for more, q to quit, c to continue without paging--
          -872071048, 32767, -1877690152, 16018, -452450919, 6541, -710547719, 9713, -452450919, 6541, -452450919, 6541, -213896015,
          6969, 3, 0, -220177007, 4549, -213896015, 6969, -1877612872, 16018, -872070928, 32767, -1877616280, 16018, -452450919, 6541,
          -219953863, 4549, -219960263, 4549, -710547719, 9713, 406791897, 5196, 1, 0, 0, 1, 0, 0, -213896015, 6969, 3, 0, -213747239,
          6969, -213896015, 6969, -1877712128, 16018, -872070816, 32767, -1877716216, 16018, 1652552377, 9632, -710812119, 9713,
          -219953863, 4549, -219960263, 4549, 1557668153, 6257, 1011109664, 1, -872070808, 32767, -219972639, 4549, 1, 0, -219960135,
          4549, -219972639, 4549, -1877662280, 16018, -872070632, 32767, -1877669852, 16018, -452450919, 6541, -710812119, 9713,
          43104233, 12685, 2491401, 507, 0, 0, -452450455, 6541, -452450919, 6541, -452450919, 6541, -452450919, 6541, -452450919, 6541,
          -452450919, 6541, 721453881, 11287, 45, 0, -219972639, 4549, -710878559, 9713, -1315907375, 592, -710878559, 9713, 2, 0...}
#4  0x000000013bb1d9b8 in v8::internal::Deoptimizer::DoComputeOutputFrames (this=0x143257880)
    at ../deps/v8/src/deoptimizer/deoptimizer.cc:889
        timer = {start_ticks_ = {<v8::base::time_internal::TimeBase<v8::base::TimeTicks>> = {<v8::base::TimeConstants> = {
                static kHoursPerDay = 24, static kMillisecondsPerSecond = 1000, static kMillisecondsPerDay = 86400000,
                static kMicrosecondsPerMillisecond = 1000, static kMicrosecondsPerSecond = 1000000,
                static kMicrosecondsPerMinute = 60000000, static kMicrosecondsPerHour = 3600000000,
                static kMicrosecondsPerDay = 86400000000, static kMicrosecondsPerWeek = 604800000000,
                static kNanosecondsPerMicrosecond = 1000, static kNanosecondsPerSecond = 1000000000},
              us_ = <optimized out>}, <No data fields>}}
        input_data = {<v8::internal::FixedArray> = {<v8::internal::TorqueGeneratedFixedArray<v8::internal::FixedArray, v8::internal::FixedArrayBase>> = {<v8::internal::FixedArrayBase> = {<v8::internal::TorqueGeneratedFixedArrayBase<v8::internal::FixedArrayBase, v8::internal::HeapObject>> = {<v8::internal::HeapObject> = {<v8::internal::Object> = {<v8::internal::TaggedImpl<(v8::internal::HeapObjectReferenceType)1, unsigned long>> = {static kIsFull = <optimized out>, static kCanBeWeak = false, ptr_ = <optimized out>},
                      static kHeaderSize = 0}, <No data fields>}, static kStartOfStrongFieldsOffset = <optimized out>,
                  static kLengthOffset = 8, static kLengthOffsetEnd = 15, static kEndOfStrongFieldsOffset = <optimized out>,
                  static kStartOfWeakFieldsOffset = <optimized out>, static kEndOfWeakFieldsOffset = <optimized out>,
                  static kHeaderSize = 16}, static kMaxSize = 1073741816}, static kStartOfStrongFieldsOffset = <optimized out>,
--Type <RET> for more, q to quit, c to continue without paging--
              static kHeaderSize = 16, static kObjectsOffset = <optimized out>, static kObjectsOffsetEnd = <optimized out>,
              static kEndOfStrongFieldsOffset = <optimized out>, static kStartOfWeakFieldsOffset = <optimized out>,
              static kEndOfWeakFieldsOffset = <optimized out>}, static kMaxLength = 134217725, static kMaxRegularLength = 32766,
            static kObjectsOffset = 16}, static kTranslationByteArrayIndex = 0, static kInlinedFunctionCountIndex = 1,
          static kLiteralArrayIndex = 2, static kOsrBytecodeOffsetIndex = 3, static kOsrPcOffsetIndex = 4,
          static kOptimizationIdIndex = 5, static kSharedFunctionInfoIndex = 6, static kInliningPositionsIndex = 7,
          static kDeoptExitStartIndex = 8, static kEagerSoftAndBailoutDeoptCountIndex = 9, static kLazyDeoptCountIndex = 10,
          static kFirstDeoptEntryIndex = 11, static kBytecodeOffsetRawOffset = 0, static kTranslationIndexOffset = 1,
          static kPcOffset = 2, static kDeoptEntrySize = 3, static kNotInlinedIndex = -1}
        stack_guard = 0x14327fb38
        bytecode_offset = {static kNoneId = -1, static kFirstBuiltinContinuationId = 1, id_ = <optimized out>}
        translations = {<v8::internal::TorqueGeneratedByteArray<v8::internal::ByteArray, v8::internal::FixedArrayBase>> = {<v8::internal::FixedArrayBase> = {<v8::internal::TorqueGeneratedFixedArrayBase<v8::internal::FixedArrayBase, v8::internal::HeapObject>> = {<v8::internal::HeapObject> = {<v8::internal::Object> = {<v8::internal::TaggedImpl<(v8::internal::HeapObjectReferenceType)1, unsigned long>> = {
                      static kIsFull = <optimized out>, static kCanBeWeak = false, ptr_ = 2177550646105},
                    static kHeaderSize = 0}, <No data fields>}, static kStartOfStrongFieldsOffset = <optimized out>,
                static kLengthOffset = 8, static kLengthOffsetEnd = 15, static kEndOfStrongFieldsOffset = <optimized out>,
                static kStartOfWeakFieldsOffset = <optimized out>, static kEndOfWeakFieldsOffset = <optimized out>,
                static kHeaderSize = 16}, static kMaxSize = 1073741816}, static kHeaderSize = 16, static kBytesOffset = <optimized out>,
            static kBytesOffsetEnd = <optimized out>, static kStartOfWeakFieldsOffset = <optimized out>,
            static kEndOfWeakFieldsOffset = <optimized out>, static kStartOfStrongFieldsOffset = <optimized out>,
            static kEndOfStrongFieldsOffset = <optimized out>}, static kAlignedSize = 16, static kMaxLength = 1073741800}
        translation_index = 1612733446
        trace_file = 0x0
        state_iterator = {uncompressed_contents_ = std::vector of length 0, capacity 0,
--Type <RET> for more, q to quit, c to continue without paging--
          buffer_ = {<v8::internal::TorqueGeneratedByteArray<v8::internal::ByteArray, v8::internal::FixedArrayBase>> = {<v8::internal::FixedArrayBase> = {<v8::internal::TorqueGeneratedFixedArrayBase<v8::internal::FixedArrayBase, v8::internal::HeapObject>> = {<v8::internal::HeapObject> = {<v8::internal::Object> = {<v8::internal::TaggedImpl<(v8::internal::HeapObjectReferenceType)1, unsigned long>> = {
                        static kIsFull = <optimized out>, static kCanBeWeak = false, ptr_ = 2177550646105},
                      static kHeaderSize = 0}, <No data fields>}, static kStartOfStrongFieldsOffset = <optimized out>,
                  static kLengthOffset = 8, static kLengthOffsetEnd = 15, static kEndOfStrongFieldsOffset = <optimized out>,
                  static kStartOfWeakFieldsOffset = <optimized out>, static kEndOfWeakFieldsOffset = <optimized out>,
                  static kHeaderSize = 16}, static kMaxSize = 1073741816}, static kHeaderSize = 16,
              static kBytesOffset = <optimized out>, static kBytesOffsetEnd = <optimized out>,
              static kStartOfWeakFieldsOffset = <optimized out>, static kEndOfWeakFieldsOffset = <optimized out>,
              static kStartOfStrongFieldsOffset = <optimized out>, static kEndOfStrongFieldsOffset = <optimized out>},
            static kAlignedSize = 16, static kMaxLength = 1073741800}, index_ = 1612733447}
        count = <optimized out>
        frame_index = <optimized out>
        total_output_frame_size = <optimized out>
        topmost = <optimized out>
#5  0x000000013c44b8bc in Builtins_DeoptimizationEntry_Lazy ()
No symbol table info available.

[john-yan]

I found the issue. It was caused by trampoline pool emission during deopt exit table generation. Deoptimizer expects deopt exits to be continuous. However, trampoline pool breaks this underlining assumption. I will submit a CL to fix this soon.

[john-yan]

https://chromium-review.googlesource.com/c/v8/v8/+/2881918