1350744 - [wasm] Crash [@ ??] involving Debugger

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 4c987b7ed54a (build with --32 --enable-debug, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

// jsfunfuzz-generated
(function () {
    // Adapted from randomly chosen test: js/src/jit-test/tests/debug/bug1133196.js
    var g = newGlobal();
    g.parent = this;
    g.eval("(" + function () {
        var dbg = new Debugger(parent);
        dbg.onExceptionUnwind = function (frame) {
            frame.older.onStep = function () {}
        };
    } + ")()");
    // awsm-generated
    try {
        exports = new WebAssembly.Instance(new WebAssembly.Module(wasmTextToBinary(`
            (module
                (func (result f64)
                    i64.const 0
                    i64.const 0
                    i64.const 0
                    drop
                    drop
                    f64.reinterpret/i64
                )
                (func (export "f2")
                    i64.const 0
                    i64.const 0
                    i64.const 0
                    i32.const 0
                    select
                    drop
                    drop
                )
            )
        `))).exports;
        exports();
    } catch (e) {};
    exports.f2();
})();

Backtrace:

#0  0x3e1e0634 in ?? ()
#1  0xfff00d34 in ?? ()
/snip

For detailed crash information, see attachment.

Setting s-s as a start, there are weird memory addresses on the stack, but also looks like a null-deref.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/36a11b6821fa
user:        Luke Wagner
date:        Wed Mar 22 17:13:02 2017 -0500
summary:     Bug 1334504 - Baldr: save TLS reg in Frame (r=bbouvier)

Luke/Benjamin, is bug 1334504 a likely regressor?

Comment 3

[Luke Wagner [:luke]]

Attachment: fix-debug-trap

With bug 1334504, prologues/epilogues now depend on TLS having been loaded and that was not happening on the debug-trap path.  This patch should look familiar to the last one of bug 1334504 since it's doing the same logical thing.

Comment 4

[Benjamin Bouvier [:bbouvier] (inactive)]

Comment on attachment 8851741 [details] [diff] [review]
fix-debug-trap

Review of attachment 8851741 [details] [diff] [review]:
-----------------------------------------------------------------

Makes sense, thanks.

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/bc25a1c06597