1506675 - Cranelift crash when running wasm demos

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect)

Description

[Benjamin Bouvier [:bbouvier] (inactive)]

I've tried running Cranelift demos after the bump to 0.23, but it seems it's still crashing on wasm demos on my machine, including:
- webassembly.org/demo
- the godot startup benchmark: http://godot.eska.me/pub/wasm-benchmark/

Crashes happen in generated code:
https://crash-stats.mozilla.com/report/index/7fcf6411-6db5-47ee-ab84-4daff0181112
https://crash-stats.mozilla.com/report/index/243393e5-828d-4ad2-998d-48eb90181112

Comment 1

[Dan Gohman [:sunfish]]

That second trace seems to show the recursion starting at js::wasm::Instance::callExport.

Comment 2

[Benjamin Bouvier [:bbouvier] (inactive)]

Can reproduce on shell test cases: wasm_fannkuch in embenchen. Investigating a bit more.

Comment 3

[Benjamin Bouvier [:bbouvier] (inactive)]

It's a problem of encoding during code generation, during the codegen of Fasta jit code. Opened https://github.com/CraneStation/cranelift/issues/600 to track it on the Cranelift side.

Comment 4

[Benjamin Bouvier [:bbouvier] (inactive)]

As of today, the Godot benchmark seems to work fine in both Cranelift-only and tiering mode with the workaround in bug 1507820.

The WebAssembly demo still crashes in generated code.

Comment 5

[Benjamin Bouvier [:bbouvier] (inactive)]

Tracked it down to https://github.com/CraneStation/cranelift/issues/666, which is quite a diabolic bug.

Comment 6

[Benjamin Bouvier [:bbouvier] (inactive)]

Confirmed that the workaround patch in bug 1507820 and fix in https://github.com/CraneStation/cranelift/pull/667 fix the crash on the WebAssembly demo website.

Comment 7

[Benjamin Bouvier [:bbouvier] (inactive)]

Was fixed in Cranelift 0.29.0.