1611085 - Land debug instrumentation patch from bug 1607443

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, task, P1)

Description

[Jan de Mooij [:jandem]]

Bug 1607670 landed yesterday so I think we fixed all known issues and should land the patch now to prevent regressions and to make fuzzing it easier.

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Bug 1611085 - Add some callVM debug instrumentation. r?tcampbell!

Comment 2

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/autoland/rev/f6f9b389bf677dc8e203777c96f33f362a1b75f8

Comment 3

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/f6f9b389bf67

Comment 4

[Andrew McCreight [:mccr8]]

Jan, could you please explain what this assertion means, in a way that doesn't require understand the JITs? I read the comment that starts with "If this MIR instruction has an overridden AliasSet" but I still don't understand what this is checking or why. Thanks.

Comment 5

[Jan de Mooij [:jandem]]

(In reply to Andrew McCreight [:mccr8] from comment #4)

Jan, could you please explain what this assertion means, in a way that doesn't require understand the JITs? I read the comment that starts with "If this MIR instruction has an overridden AliasSet" but I still don't understand what this is checking or why. Thanks.

MIR instructions have a way to describe what side effects they have (using alias sets). The recent 0-day was caused by this information being incorrect: Ion would assume an instruction (calling into C++) could only store to object elements, but the exploit code was able to invoke arbitrary JS (via setters) breaking JIT optimizations based on the buggy alias set.

The assert added here catches the worst of these bugs: if a MIR instruction says it doesn't have all possible side-effects, then we check in debug builds that this MIR instruction cannot call into JS in any way (because calling into JS is the typical "anything can happen, we can exploit this" scenario).

I hope this helps.

Comment 6

[Andrew McCreight [:mccr8]]

Thanks. That does help.