1356068 - Crash [@ ??] involving asm.js (more-deterministic only)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision fac2c174087f (build with --32 --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

f = (function (stdlib, foreign, heap) {
    "use asm";
    var ff = foreign.ff;
    function f(x) {
        x = +x;
        +ff(x);
    }
    return f;
})(this, {
        ff: Math.sin
    },
    Array
);
f();

Backtrace:

#0  0x2f39e225 in ?? ()
#1  0xf625f000 in ?? ()
#2  0xf625f000 in ?? ()
/snip

For detailed crash information, see attachment.

Setting s-s because only memory addresses are on the stack.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/291cfed3e754
user:        Benjamin Bouvier
date:        Mon Apr 10 13:43:59 2017 +0200
summary:     Bug 1340219: Baldr: Make calls to builtin imports fast in wasm; r=luke

Benjamin, is bug 1340219 a likely regressor?

Comment 3

[Benjamin Bouvier [:bbouvier] (inactive)]

Another more-deterministic only bug; I guess that since the builtin thunk can have move of FP constants, some canonicalizeIfDeterministic calls are in there, implying we create constant pools. These are never flushed in the code! That would be better to do anyway, so the fix should be hopefully trivial.

Comment 4

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: processcodelabels.patch

With a few more assertions, to make our intents clearer here.

Comment 5

[Luke Wagner [:luke]]

Comment on attachment 8857899 [details] [diff] [review]
processcodelabels.patch

Review of attachment 8857899 [details] [diff] [review]:
-----------------------------------------------------------------

Good fix

Comment 6

[Andrew McCreight [:mccr8]]

Can we unhide this? Does it only affect a debugging mode?

Comment 7

[Benjamin Bouvier [:bbouvier] (inactive)]

(In reply to Andrew McCreight [:mccr8] from comment #6)
> Can we unhide this? Does it only affect a debugging mode?

Yes, it only affects the more-deterministic mode, which is a special build mode for fuzzers that we don't use otherwise. I can't be able to unhide it myself, though.

Comment 8

[Benjamin Bouvier [:bbouvier] (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d312e03e3f5eb49939409095abad057abf3eb4d4

Comment 9

[Iris Hsiao [:ihsiao]]

https://hg.mozilla.org/mozilla-central/rev/d312e03e3f5e