1141921 - Crash during bug860838-3 test on IonMonkey for MIPS32

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[hev [:hev]]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:36.0) Gecko/20100101 Firefox/36.0
Build ID: 20150305221847

Steps to reproduce:

Run test by:
python2 ./jit_test.py -g --args="--no-ion" ../mips/js/src/shell/js ion/bug860838-3.js

Issue:
Program received signal SIGSEGV, Segmentation fault.                                                                           [5/16512]
0x0879684b in js::jit::Simulator::readW (this=0x8cb0020, addr=24, instr=0xb5d65950)
    at /home/heiher/git/loongson/gecko-dev/js/src/jit/mips/Simulator-mips.cpp:1627
1627            MOZ_CRASH();
(gdb) bt
#0  0x0879684b in js::jit::Simulator::readW (this=0x8cb0020, addr=24, instr=0xb5d65950)
    at /home/heiher/git/loongson/gecko-dev/js/src/jit/mips/Simulator-mips.cpp:1627
#1  0x08729c7d in js::jit::Simulator::decodeTypeImmediate (this=0x8cb0020, instr=0xb5d65950)
    at /home/heiher/git/loongson/gecko-dev/js/src/jit/mips/Simulator-mips.cpp:3089
#2  0x0872a3ba in js::jit::Simulator::instructionDecode (this=0x8cb0020, instr=0xb5d65950)
    at /home/heiher/git/loongson/gecko-dev/js/src/jit/mips/Simulator-mips.cpp:3284
#3  0x0879ff62 in js::jit::Simulator::execute<false> (this=0x8cb0020)
    at /home/heiher/git/loongson/gecko-dev/js/src/jit/mips/Simulator-mips.cpp:3326
#4  0x0872a67f in js::jit::Simulator::callInternal (this=0x8cb0020, entry=0xb7fd6000 "\374\377\275'")
    at /home/heiher/git/loongson/gecko-dev/js/src/jit/mips/Simulator-mips.cpp:3384
#5  0x0872ab65 in js::jit::Simulator::call (this=0x8cb0020, entry=0xb7fd6000 "\374\377\275'", argument_count=2)
    at /home/heiher/git/loongson/gecko-dev/js/src/jit/mips/Simulator-mips.cpp:3442
#6  0x08102ec1 in CallAsmJS (cx=0x8cb0e90, argc=0, vp=0xb40feeb8) at /home/heiher/git/loongson/gecko-dev/js/src/asmjs/AsmJSLink.cpp:754
#7  0x08726397 in js::jit::Simulator::softwareInterrupt (this=0x8cb0020, instr=0x8d6bcb4)
    at /home/heiher/git/loongson/gecko-dev/js/src/jit/mips/Simulator-mips.cpp:1896
#8  0x087293e0 in js::jit::Simulator::decodeTypeRegister (this=0x8cb0020, instr=0x8d6bcb4)
    at /home/heiher/git/loongson/gecko-dev/js/src/jit/mips/Simulator-mips.cpp:2862
#9  0x0872a3a7 in js::jit::Simulator::instructionDecode (this=0x8cb0020, instr=0x8d6bcb4)
    at /home/heiher/git/loongson/gecko-dev/js/src/jit/mips/Simulator-mips.cpp:3281
#10 0x0879ff62 in js::jit::Simulator::execute<false> (this=0x8cb0020)
    at /home/heiher/git/loongson/gecko-dev/js/src/jit/mips/Simulator-mips.cpp:3326
#11 0x0872a67f in js::jit::Simulator::callInternal (this=0x8cb0020, entry=0xb5a6e77c "\250\377\275'T")
    at /home/heiher/git/loongson/gecko-dev/js/src/jit/mips/Simulator-mips.cpp:3384
#12 0x0872ab65 in js::jit::Simulator::call (this=0x8cb0020, entry=0xb5a6e77c "\250\377\275'T", argument_count=8)
    at /home/heiher/git/loongson/gecko-dev/js/src/jit/mips/Simulator-mips.cpp:3442
#13 0x084b358a in EnterBaseline (cx=0x8cb0e90, data=...) at /home/heiher/git/loongson/gecko-dev/js/src/jit/BaselineJIT.cpp:122
#14 0x084b3c12 in js::jit::EnterBaselineAtBranch (cx=0x8cb0e90, fp=0x8d01150, pc=0x8d69fff "\343\202Q\f\f\270")
    at /home/heiher/git/loongson/gecko-dev/js/src/jit/BaselineJIT.cpp:210
#15 0x08285adf in Interpret (cx=0x8cb0e90, state=...) at /home/heiher/git/loongson/gecko-dev/js/src/vm/Interpreter.cpp:1735
#16 0x08280fdd in js::RunScript (cx=0x8cb0e90, state=...) at /home/heiher/git/loongson/gecko-dev/js/src/vm/Interpreter.cpp:448

Configure arugments:
../configure --prefix=/usr --enable-debug --disable-optimize --with-system-nspr --with-system-zlib --enable-system-ffi --with-system-icu --enable-mips-simulator

Comment 1

[hev [:hev]]

jit/BaselineCompiler.cpp:
 630 bool
 631 BaselineCompiler::initScopeChain()
 632 {
 633     CallVMPhase phase = POST_INITIALIZE;
 634     if (needsEarlyStackCheck())
 635         phase = CHECK_OVER_RECURSED;
 636 
 637     RootedFunction fun(cx, function());
 638     if (fun) {
 639         // Use callee->environment as scope chain. Note that we do
 640         // this also for heavy-weight functions, so that the scope
 641         // chain slot is properly initialized if the call triggers GC.
 642         Register callee = R0.scratchReg();
 643         Register scope = R1.scratchReg();
 644         masm.as_break(0);
	     // Looks like BaselineFrameReg is wrong, I don't kown why, but the right
             // value should is current value (0xb3ffedb8) - 8.
 645         masm.loadFunctionFromCalleeToken(frame.addressOfCalleeToken(), callee);
 646         masm.loadPtr(Address(callee, JSFunction::offsetOfEnvironment()), scope);
 647         masm.storePtr(scope, frame.addressOfScopeChain());

This is generated MIPS native codes by above C++ codes.
sim> di
0xb5d65948      break
0xb5d6594c      lw      $6, 12($21)
0xb5d65950      addiu   $1, $zero, -4
0xb5d65954      and     $6, $6, $1
0xb5d65958      lw      $22, 24($6)
0xb5d6595c      sw      $22, -24($21)
0xb5d65960      move    $22, $sp
0xb5d65964      lui     $1, 2249
0xb5d65968      ori     $1, $1, 22416
0xb5d6596c      lw      $1, 0($1)
sim> mem s5
  0xb3ffedb8:  0x00004a4c      19020
  0xb3ffedbc:  0x00000243        579
  0xb3ffedc0:  0xb3c561a0 -1278910048  // This is right callee, write at asmjs/AsmJSValidate.cpp:8600
  0xb3ffedc4:  0x00000001          1
  0xb3ffedc8:  0x00000000          0
  0xb3ffedcc:  0xffffff82       -126
  0xb3ffedd0:  0x00000001          1
  0xb3ffedd4:  0x00000000          0
  0xb3ffedd8:  0xb7fdf048 -1208094648
  0xb3ffeddc:  0x0008fff7     589815

Comment 2

[hev [:hev]]

@rankov Do you have any tips?

Comment 3

[hev [:hev]]

Attachment: OdinMonkey-MIPS-Fix-callJitFromAsmJS-to-push-return-.patch

This patch to fix callJitFromAsmJS to push the return address in calling.

The right stack layout:
	|
	|...
	|arg2
	|arg1
	|this
	|argc
	|callee
	|desc   <--------- BaselineStackReg
	|retaddr
	|saved framepoint <----- BaselineFrameReg
	|
	|

The wrong stack layout:
	|
	|...
	|arg2
	|arg1
	|this
	|argc
	|callee
	|desc   <--------- BaselineStackReg
	 !!! retaddr <------ (MIPS::callJitFromAsmJS not pushed the retaddr into stack.
			Why ARM works ok? because it defined JS_USE_LINK_REGISTER and
			to do save retaddr in the callee function.
	|saved framepoint <----- BaselineFrameReg
	|
	|

Comment 4

[Nicolas B. Pierron [:nbp] {away}]

Comment on attachment 8579960 [details] [diff] [review]
OdinMonkey-MIPS-Fix-callJitFromAsmJS-to-push-return-.patch

Review of attachment 8579960 [details] [diff] [review]:
-----------------------------------------------------------------

Sorry for the delay, Sounds good :)

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d295523e4567

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/d295523e4567