1352500 - Hit MOZ_CRASH(ARM simulator breakpoint) at js/src/jit/arm/Simulator-arm.cpp:3185 with asm.js

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 8df9fabf2587 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-stdcxx-compat --disable-profiling --enable-debug --without-intl-api --enable-optimize --target=i686-pc-linux-gnu --enable-simulator=arm, run with --fuzzing-safe --arm-hwcap=vfp --ion-offthread-compile=off):

function asmCompile() {
    var f = Function.apply(null, arguments);
    return f;
}
setJitCompilerOption('asmjs.atomics.enable', 1);
var m1 = asmCompile("stdlib", "ffi", "heap", `
    "use asm";
    var i8 = new stdlib.Int8Array(heap);
    var add = stdlib.Atomics.add;
    function f() {
	add(i8, 0, 1);
    }
    return { f:f }
`);
var { f } = m1(this, {}, new SharedArrayBuffer(65536));
f();



Backtrace:

 received signal SIGSEGV, Segmentation fault.
0x08513288 in js::jit::Simulator::decodeType01 (this=0xf7968000, instr=0x5ace2028) at js/src/jit/arm/Simulator-arm.cpp:3185
#0  0x08513288 in js::jit::Simulator::decodeType01 (this=0xf7968000, instr=0x5ace2028) at js/src/jit/arm/Simulator-arm.cpp:3185
#1  0x0850fdba in js::jit::Simulator::instructionDecode (this=0xf7968000, instr=0x5ace2028) at js/src/jit/arm/Simulator-arm.cpp:4687
#2  0x0851390a in js::jit::Simulator::execute<false> (this=0xf7968000) at js/src/jit/arm/Simulator-arm.cpp:4760
#3  js::jit::Simulator::callInternal (this=0xf7968000, entry=0x5ace2068 "\004\340-\345\360\037-\351\020\212", <incomplete sequence \355>) at js/src/jit/arm/Simulator-arm.cpp:4848
#4  0x08513bf1 in js::jit::Simulator::call (this=<optimized out>, entry=0x5ace2068 "\004\340-\345\360\037-\351\020\212", <incomplete sequence \355>, argument_count=<optimized out>) at js/src/jit/arm/Simulator-arm.cpp:4931
#5  0x08929790 in js::wasm::Instance::callExport (this=0xf5175280, cx=0xf791d000, funcIndex=4097, args=...) at js/src/wasm/WasmInstance.cpp:655
#6  0x0892a1ec in WasmCall (cx=0xf791d000, argc=0, vp=0xf5056058) at js/src/wasm/WasmJS.cpp:1114
#7  0x0817a537 in js::CallJSNative (cx=0xf791d000, native=0x892a140 <WasmCall(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:282
[...]
#21 main (argc=5, argv=0xffffcda4, envp=0xffffcdbc) at js/src/shell/js.cpp:8664
eax	0x0	0
ebx	0x8cdfff4	147718132
ecx	0xf7da4864	-136689564
edx	0x0	0
esi	0x8cdfff4	147718132
edi	0xf7da3df8	-136692232
ebp	0xffffbd58	4294950232
esp	0xffffbd00	4294950144
eip	0x8513288 <js::jit::Simulator::decodeType01(js::jit::SimInstruction*)+5112>
=> 0x8513288 <js::jit::Simulator::decodeType01(js::jit::SimInstruction*)+5112>:	movl   $0x0,0x0
   0x8513292 <js::jit::Simulator::decodeType01(js::jit::SimInstruction*)+5122>:	ud2    


This seems pretty much identical to bug 1350552 but still reproduces on tip.

Comment 1

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: setperformcall.patch

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/26c12944db87
Baldr: Force stack alignment for asm.js atomics callouts on ARM; r=luke

Comment 3

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/26c12944db87

Comment 4

[Lars T Hansen [:lth]]

At the risk of repeating myself, Tier3 (ARMv6) bugs really ought not be labeled critical.

Comment 5

[Christian Holler (:decoder)]

(In reply to Lars T Hansen [:lth] from comment #4)
> At the risk of repeating myself, Tier3 (ARMv6) bugs really ought not be
> labeled critical.

We file bugs with templates and the default template has "critical" for the severity because that has always been the standard severity for JS bugs. We often cannot determine is something is Tier1 or Tier3 so this should be changed by JS triage when appropriate.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Should we consider backporting this or can it ride the trains?

Comment 7

[Benjamin Bouvier [:bbouvier] (inactive)]

We could backport for fuzzing.

Comment 8

[Benjamin Bouvier [:bbouvier] (inactive)]

Comment on attachment 8853487 [details] [diff] [review]
setperformcall.patch

Approval Request Comment
[Feature/Bug causing the regression]: atomics in asm.js
[User impact if declined]: crashes on tier-3 platforms (arm v6)
[Is this code covered by automated tests?]: no
[Has the fix been verified in Nightly?]: yes
[Needs manual test from QE? If yes, steps to reproduce]: no
[List of other uplifts needed for the feature/fix]: none
[Is the change risky?]: not much
[Why is the change risky/not risky?]: patch is only a few lines of code
[String changes made/needed]: n/a

Comment 9

[Gerry Chang [:gchang]]

Comment on attachment 8853487 [details] [diff] [review]
setperformcall.patch

We can take this in Aurora to fix crashes on tier-3 platforms. Aurora54+.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/e99180e4d046