Failure in creating snapshot (return -11) when set v8_enable_builtins_profiling = true

[Sizheng]

Hi,

Working on chromium version of 13.2.23. We are trying to get v8 builtin pgo files on arm64 architecture,  our compilation architecture is x64, so we set v8_enable_builtins_profiling = true，and build configs is set as follow:

{
  "arch": "arm64",
  "asan": false,
  "atomic_object_field_writes": true,
  "cet_shadow_stack": false,
  "cfi": false,
  "clang": true,
  "clang_coverage": false,
  "code_comments": false,
  "component_build": false,
  "concurrent_marking": true,
  "conservative_stack_scanning": false,
  "current_cpu": "x64",
  "dcheck_always_on": false,
  "debug_code": false,
  "DEBUG_defined": false,
  "debugging_features": false,
  "dict_property_const_tracking": false,
  "direct_handle": false,
  "disassembler": false,
  "full_debug": false,
  "gdbjit": false,
  "has_jitless": false,
  "has_maglev": true,
  "has_turbofan": true,
  "has_webassembly": true,
  "has_wasm_interpreter": false,
  "i18n": true,
  "is_android": false,
  "is_ios": false,
  "js_shared_memory": true,
  "lite_mode": false,
  "local_off_stack_check": false,
  "mips_arch_variant": "",
  "mips_use_msa": false,
  "msan": false,
  "official_build": false,
  "pointer_compression": true,
  "pointer_compression_shared_cage": true,
  "runtime_call_stats": true,
  "sandbox": true,
  "shared_ro_heap": true,
  "simd_mips": false,
  "simulator_run": true,
  "single_generation": false,
  "slow_dchecks": false,
  "target_cpu": "x64",
  "tsan": false,
  "ubsan": false,
  "use_sanitizer": false,
  "v8_cfi": true,
  "v8_current_cpu": "arm64",
  "v8_target_cpu": "arm64",
  "verify_csa": false,
  "verify_heap": false,
  "verify_predictable": false,
  "wasm_random_fuzzers": true,
  "memory_corruption_api": false,
  "leaptiering": true
}

However, a failure in creating snapshot (return -11) was encountered during building process. Here is the error message:

ninja: Entering directory `out.gn/arm64.release'
[0/1] Regenerating ninja files
[1098/1887] ACTION //:run_mksnapshot_default(//build/toolchain/linux:clang_x64)
FAILED: [code=245] gen/embedded.S snapshot_blob.bin
python3 ../../tools/run.py ./mksnapshot --turbo_instruction_scheduling --stress-turbo-late-spilling --target_os=linux --target_arch=x64 --embedded_src gen/embedded.S --predictable --no-use-ic --turbo-profiling --target_is_simulator --embedded_variant Default --random-seed 314159265 --startup_blob snapshot_blob.bin --no-native-code-counters
Return code is -11
[1129/1887] CXX obj/test/cctest/cctest_sources/test-api.o
ninja: build stopped: subcommand failed.

Any solution or suggestion to the above issue would be of great value and appreciated! Thanks!

[Sizheng]

After some bisection, it seems that this commit causes the problem:

commit bb437769cfd01b2d93a5e749cb0e784af252dcc7
Author: Nico Hartmann <nicoha...@chromium.org>
Date:   Wed Aug 28 16:36:28 2024 +0200

    [builtins][turboshaft] Enable --turboshaft-csa once again
   
    After all crashes and issues we had with the switch to the Turboshaft
    pipeline for builtins ended up being resolved or turned out to be not
    reproducible, it's another shot to flip this flag to either verify that
    all issues are indeed fixed or to collect new reproducers at least.
   
    Bug: chromium:348031042, chromium:349533472
    Change-Id: I11f3e6069fef86673f9dc9ce161a81447399c2e4
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5823192
    Reviewed-by: Matthias Liedtke <mlie...@chromium.org>
    Commit-Queue: Nico Hartmann <nicoha...@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#95876}

It  would be of great help if @ nicohartmann @ mliedtke could look into this issue.