1628417 - Crash [@ ??] with --wasm-gc

Status: VERIFIED FIXED

(Core :: JavaScript: WebAssembly, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20200408-6663d3dc883b (build with (buildFlags not available), run with --fuzzing-safe --ion-offthread-compile=off --wasm-gc test.js):

See attachment.

Backtrace:

received signal SIGSEGV, Segmentation fault.
0x00000bbbc85be097 in ?? ()
#0  0x00000bbbc85be097 in ?? ()
#1  0x00007ffff5e27000 in ?? ()
#2  0x00007ffff5e3f0a0 in ?? ()
#3  0x0000000000000000 in ?? ()
rax	0x2	2
rbx	0x7ffff5e7a5b0	140737318987184
rcx	0x0	0
rdx	0x1	1
rsi	0x7ffff4bfc000	140737299595264
rdi	0x7ffff5e3f0a0	140737318744224
rbp	0x7fffffffb4d8	140737488336088
rsp	0x7fffffffb4c8	140737488336072
r8	0x7fffffffb8b8	140737488337080
r9	0x7ffff6c961d0	140737333780944
r10	0x0	0
r11	0xbbbc85be072	12901148254322
r12	0x7ffff5e27000	140737318645760
r13	0x7ffff5e27000	140737318645760
r14	0x7ffff4bfc000	140737299595264
r15	0x0	0
rip	0xbbbc85be097	12901148254359
=> 0xbbbc85be097:	mov    %r12,(%r10)
   0xbbbc85be09a:	add    $0x8,%rsp

Marking as fuzzblocker due to lack of attributes to match on in the crash trace, making this hard to bucket.

Comment 1

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 2

[Andy Wingo [:wingo]]

Thanks!! Here is a simple test case:

let bytes = wasmTextToBinary(`
   (module
     (func $main (export "main") (result i32 i32)
       (i32.const 1)
       (i32.const 2)
       (i32.const 0)
       (br_table 0 0)))`);

let instance = new WebAssembly.Instance(new WebAssembly.Module(bytes));

instance.exports.main();

Note, the trigger for this bug is rather --wasm-compiler=baseline; because gc isn't supported on Ion, --wasm-gc simply forces usage of the baseline compiler.

Comment 3

[Andy Wingo [:wingo]]

Emitted code, for the record

;; ========================================
;; Emitting wasm baseline code
;; beginFunction: start of function prologue for index 0
.balign 16, 0xf4   ; hlt
	movq       0x60(%r14), %rax
	cmpq       %rax, %r10
	je         L13
	ud2
.balign 16
L13:
	push       %r14
	push       %rbp
	movq       %rsp, %rbp
	movq       %rsp, %rax
	addq       $0x0000, %rax
	cmpq       %rax, 0x30(%r14)
	jb         L41
	ud2
L41:
	subq       $16, %rsp
	movq       %rdi, 0x8(%rsp)
        ;; beginFunction: enter body with masm.framePushed = 16
	xorl       %ecx, %ecx
	movl       $0x2, %eax
	subq       $8, %rsp
	movl       $0x1, %edx
	movl       %edx, 0x0(%rsp)
	cmpl       $0x1, %ecx
	jb         L80
	addq       $8, %rsp
	jmp        L89
	addq       $8, %rsp
	jmp        L98
L80:
	movabsq    $0x0, %r11
	jmp        *0x0(%r11,%rcx,8)
L98:        
L89:        
	jmp        L125
	;; endFunction: start of function epilogue
	int3
L125:      
	movq       0x10(%rsp), %r10
	movq       0x0(%rsp), %r12
	movq       %r12, 0x0(%r10)
	addq       $8, %rsp
	addq       $16, %rsp
	pop        %rbp
	pop        %r14
	ret
	;; endFunction: end of function epilogue

Comment 4

[Andy Wingo [:wingo]]

Attachment: Bug 1628417 - Fix multi-value br stack value shuffling in baseline compiler

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/af2e64962ccf
Fix multi-value br stack value shuffling in baseline compiler r=bbouvier

Comment 6

[Daniel Varga [:dvarga]]

https://hg.mozilla.org/mozilla-central/rev/af2e64962ccf

Comment 7

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as fixed on rev mozilla-central 20200423095248-47426d145e24.
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.