1592958 - Ensure new WebAssembly blocks have slots enough for predecessor results

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P1)

Description

[Andy Wingo [:wingo]]

Bug fixes an issue in which returning more than one value from a WebAssembly block via fallthrough would stomple memory, because only 1 slot was reserved in the successor.

Test case (uncommitted, depends on bug 1586207 for codegen, and bug 1584097 for actually assembling the test case):

wasmFullPass(`
  (module
    (func (export "run") (result i32)
      (i32.add
        (loop (result i32 i32)
          (i32.const 32)
          (i32.const 10)))))`,
            42);

The error I was getting before fixing the bug:

Thread 1 "js" received signal SIGSEGV, Segmentation fault.
js::jit::FixedList<js::jit::MDefinition*>::operator[] (this=<optimized out>, index=<optimized out>) at /home/wingo/src/mozilla-unified/js/src/jit/FixedList.h:79
79	    MOZ_ASSERT(index < length_);
(gdb) bt
#0  js::jit::FixedList<js::jit::MDefinition*>::operator[] (this=<optimized out>, index=<optimized out>) at /home/wingo/src/mozilla-unified/js/src/jit/FixedList.h:79
#1  js::jit::MBasicBlock::pop (this=<optimized out>) at /home/wingo/src/mozilla-unified/js/src/jit/MIRGraph.h:213
#2  (anonymous namespace)::FunctionCompiler::popPushedDefs (this=0x7fffffff7578, defs=0x7fffffff70a0) at /home/wingo/src/mozilla-unified/js/src/wasm/WasmIonCompile.cpp:1209
#3  0x0000555557aa2447 in (anonymous namespace)::FunctionCompiler::closeLoop (this=0x7fffffff7578, loopHeader=<optimized out>, loopResults=0x7fffffff70a0) at /home/wingo/src/mozilla-unified/js/src/wasm/WasmIonCompile.cpp:1469
#4  EmitEnd (f=...) at /home/wingo/src/mozilla-unified/js/src/wasm/WasmIonCompile.cpp:1853
#5  EmitBodyExprs (f=...) at /home/wingo/src/mozilla-unified/js/src/wasm/WasmIonCompile.cpp:3392
#6  0x0000555557a97ec2 in js::wasm::IonCompileFunctions (env=..., lifo=..., inputs=..., code=0x7ffff415e780, error=0x7fffffffa430) at /home/wingo/src/mozilla-unified/js/src/wasm/WasmIonCompile.cpp:4226

Comment 1

[Andy Wingo [:wingo]]

Attachment: Bug 1592958 - Ensure new WebAssembly blocks have slots enough for predecessor results

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7da36585e596
Ensure new WebAssembly blocks have slots enough for predecessor results r=jandem

Comment 3

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/7da36585e596