1341069 - [wasm] Hit MOZ_CRASH(unexpected operand kind) at js/src/jit/x86-shared/Assembler-x86-shared.h:532

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The attached binary WebAssembly testcase crashes on mozilla-inbound revision fbe76e704b6b+ (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-address-sanitizer --disable-jemalloc --enable-optimize=-O2 --without-intl-api --enable-debug). To reproduce, you can run the following code in the JS shell (running with --wasm-always-baseline might be necessary):

var data = os.file.readFile(file, 'binary');
new WebAssembly.Instance(new WebAssembly.Module(data.buffer));



Backtrace:

==21841==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000e8db72 bp 0x7ffec132f690 sp 0x7ffec132f650 T0)
    #0 0xe8db71 in js::jit::AssemblerX86Shared::movl(js::jit::Register, js::jit::Operand const&) js/src/jit/x86-shared/Assembler-x86-shared.h:532:13
    #1 0x2211c60 in js::jit::MacroAssemblerX86Shared::move32(js::jit::Register, js::jit::Operand const&) js/src/jit/x86-shared/MacroAssembler-x86-shared.h:140:9
    #2 0x2211c60 in js::jit::MoveEmitterX86::emitInt32Move(js::jit::MoveOperand const&, js::jit::MoveOperand const&, js::jit::MoveResolver const&, unsigned long) js/src/jit/x86-shared/MoveEmitter-x86-shared.cpp:388
    #3 0x2208f11 in js::jit::MoveEmitterX86::emit(js::jit::MoveResolver const&) js/src/jit/x86-shared/MoveEmitter-x86-shared.cpp:157:13
    #4 0x1449c1b in js::jit::CodeGenerator::visitMoveGroup(js::jit::LMoveGroup*) js/src/jit/CodeGenerator.cpp:3060:5
    #5 0x1482bfb in js::jit::CodeGenerator::generateBody() js/src/jit/CodeGenerator.cpp:5317:13
    #6 0x14e8805 in js::jit::CodeGenerator::generateWasm(js::wasm::SigIdDesc, js::wasm::TrapOffset, js::wasm::FuncOffsets*) js/src/jit/CodeGenerator.cpp:9447:10
    #7 0xd290bd in js::wasm::IonCompileFunction(js::wasm::CompileTask*, js::wasm::FuncCompileUnit*, mozilla::UniquePtr<char [], JS::FreePolicy>*) js/src/wasm/WasmIonCompile.cpp:3699:14
    #8 0xc94e45 in js::wasm::CompileFunction(js::wasm::CompileTask*, mozilla::UniquePtr<char [], JS::FreePolicy>*) js/src/wasm/WasmGenerator.cpp:1208:18
    #9 0xc94780 in js::wasm::ModuleGenerator::launchBatchCompile() js/src/wasm/WasmGenerator.cpp:946:14
    #10 0xc95e9e in js::wasm::ModuleGenerator::finishFuncDefs() js/src/wasm/WasmGenerator.cpp:993:26
    #11 0xc52499 in DecodeCodeSection(js::wasm::Decoder&, js::wasm::ModuleGenerator&) js/src/wasm/WasmCompile.cpp:90:12
    #12 0xc52499 in js::wasm::Compile(js::wasm::ShareableBytes const&, js::wasm::CompileArgs const&, mozilla::UniquePtr<char [], JS::FreePolicy>*) js/src/wasm/WasmCompile.cpp:126
    #13 0xdd3135 in js::wasm::Eval(JSContext*, JS::Handle<js::TypedArrayObject*>, JS::Handle<JSObject*>, JS::MutableHandle<js::WasmInstanceObject*>) js/src/wasm/WasmJS.cpp:399:27
    #14 0x5eeebb in WasmLoop(JSContext*, unsigned int, JS::Value*) js/src/shell/js.cpp:5851:14
[...]
    #28 0x4654d8 in _start (/home/ubuntu/build/build/js+0x4654d8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV js/src/jit/x86-shared/Assembler-x86-shared.h:532:13 in js::jit::AssemblerX86Shared::movl(js::jit::Register, js::jit::Operand const&)
==21841==ABORTING


Marking s-s until triaged because this looks like a low-level assembler assertion and wasm is now enabled in the browser.

Comment 1

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 2

[Benjamin Bouvier [:bbouvier] (inactive)]

Doesn't reproduce on trunk, probably because of the recent spec change update. I'll go further.

Comment 3

[Benjamin Bouvier [:bbouvier] (inactive)]

Can't repro on the indicated changeset, and I've tried a few and couldn't reproduce, either on x86 or x64.

Christian, can we have a precise regression range, please?

Comment 4

[Christian Holler (:decoder)]

I tested this again after luke landed his patch and it reproduced fine, but on tip it doesn't reproduce anymore. I can't tell exactly why it reproduced first and now it doesn't. Closing as WFM and I will re-report this if I see it again.