1357053 - Assertion failure: offsetInCode >= codeRange->begin(), at js/src/wasm/WasmFrameIterator.cpp:613 with enableGeckoProfiling and asm.js

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision ce69b6e1773e (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-stdcxx-compat --disable-profiling --enable-debug --without-intl-api --enable-optimize --target=i686-pc-linux-gnu --enable-simulator=arm, run with --fuzzing-safe --ion-offthread-compile=off --arm-asm-nop-fill=1):

const USE_ASM = '"use asm";';
function asmCompile() {
    var f = Function.apply(null, arguments);
    return f;
}
function asmLink(f) {
    return f.apply(null, Array.slice(arguments, 1));
}
enableGeckoProfiling();
function testBuiltinF2F(name) {
    var m = asmCompile('g', USE_ASM + "var tof=g.Math.fround; var fun=g.Math." + name + "; function f(d) { d=tof(d); return tof(fun(d)) } return f");
    var f = asmLink(m, this);
    enableSingleStepProfiling();
    assertEq(f(.1), eval("Math.fround(Math." + name + "(Math.fround(.1)))"));
}
for (name of ['ceil', 'floor']) testBuiltinF2F(name);



Backtrace:

 received signal SIGSEGV, Segmentation fault.
0x08923dc6 in js::wasm::ProfilingFrameIterator::ProfilingFrameIterator (this=0xffffbc1c, activation=..., state=...) at js/src/wasm/WasmFrameIterator.cpp:613
#0  0x08923dc6 in js::wasm::ProfilingFrameIterator::ProfilingFrameIterator (this=0xffffbc1c, activation=..., state=...) at js/src/wasm/WasmFrameIterator.cpp:613
#1  0x087cbe90 in JS::ProfilingFrameIterator::iteratorConstruct (this=0xffffbc0c, state=...) at js/src/vm/Stack.cpp:1874
#2  0x087cce05 in JS::ProfilingFrameIterator::ProfilingFrameIterator (this=0xffffbc0c, cx=0xf791d000, state=..., sampleBufferGen=4294967295) at js/src/vm/Stack.cpp:1822
#3  0x080a1099 in SingleStepCallback (arg=0xf791d000, sim=<optimized out>, pc=<optimized out>) at js/src/shell/js.cpp:5332
#4  0x08513ee0 in js::jit::Simulator::execute<false> (this=0xf796f000) at js/src/jit/arm/Simulator-arm.cpp:4799
#5  js::jit::Simulator::callInternal (this=0xf796f000, entry=0x318e30d0 "\377\377\377\352\004\340-\345\377\377\377\352\360\037-\351\377\377\377\352\020\212-\355\377\377\377", <incomplete sequence \352>) at js/src/jit/arm/Simulator-arm.cpp:4886
#6  0x08514141 in js::jit::Simulator::call (this=<optimized out>, entry=0x318e30d0 "\377\377\377\352\004\340-\345\377\377\377\352\360\037-\351\377\377\377\352\020\212-\355\377\377\377", <incomplete sequence \352>, argument_count=<optimized out>) at js/src/jit/arm/Simulator-arm.cpp:4969
#7  0x08930ec0 in js::wasm::Instance::callExport (this=0xf51986a0, cx=0xf791d000, funcIndex=4097, args=...) at js/src/wasm/WasmInstance.cpp:784
#8  0x08931918 in WasmCall (cx=0xf791d000, argc=1, vp=0xf50690e8) at js/src/wasm/WasmJS.cpp:1114
#9  0x0817a7e6 in js::CallJSNative (cx=0xf791d000, native=0x8931870 <WasmCall(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:291
[...]
eax	0x0	0
ebx	0xffffbc1c	-17380
ecx	0xf7da4864	-136689564
edx	0x0	0
esi	0xffffbbe8	-17432
edi	0x8cf1ff4	147791860
ebp	0xffffbb18	4294949656
esp	0xffffbae0	4294949600
eip	0x8923dc6 <js::wasm::ProfilingFrameIterator::ProfilingFrameIterator(js::WasmActivation const&, JS::ProfilingFrameIterator::RegisterState const&)+726>
=> 0x8923dc6 <js::wasm::ProfilingFrameIterator::ProfilingFrameIterator(js::WasmActivation const&, JS::ProfilingFrameIterator::RegisterState const&)+726>:	movl   $0x0,0x0
   0x8923dd0 <js::wasm::ProfilingFrameIterator::ProfilingFrameIterator(js::WasmActivation const&, JS::ProfilingFrameIterator::RegisterState const&)+736>:	ud2

Comment 1

[Luke Wagner [:luke]]

Attachment: fix-builtin-thunk

Easy enough fix: the beginning of a thunk isn't necessarily the right instruction to call: it can be padded with bkpts (for alignment) or have random nops that mess up the CodeRange.

Comment 2

[Benjamin Bouvier [:bbouvier] (inactive)]

Comment on attachment 8859232 [details] [diff] [review]
fix-builtin-thunk

Review of attachment 8859232 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks!

::: js/src/jit-test/tests/wasm/regress/builtin-thunk-begin.js
@@ +8,5 @@
> +    quit();
> +}
> +
> +enableGeckoProfiling();
> +var m = new Function('g', "'use asm'; var tof=g.Math.fround; var fun=g.Math.ceil; function f(d) { d=tof(d); return tof(fun(d)) } return f");

Should this file be put under the asmjs/ test directory? (or should we move all the asmjs tests into a subdir of the wasm test directory)

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/56e606097382
Baldr: include initial offset in thunk address (r=bbouvier)

Comment 4

[Luke Wagner [:luke]]

Oops, right, moved to asmjs test dir.

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/56e606097382