1657888 - Cranelift: Crash [@ js::gc::detail::GetCellLocation] with Cranelift

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect, P1)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 95cbd1379138 ((buildtype not available) build, run with --no-threads --disable-oom-functions --wasm-compiler=cranelift test.js):

See attachment.

Backtrace:

==10518==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x7ffff80fffe8 (pc 0xaaaae8e6fa6c bp 0xffffe22e3800 sp 0xffffe22e3800 T10518)
==10518==The signal is caused by a READ memory access.
    #0 0xaaaae8e6fa6c in js::gc::detail::GetCellLocation(void const*) dist/include/js/HeapAPI.h:512:10
    #1 0xaaaae8e6fa6c in js::gc::IsCellPointerValid(void const*) dist/include/js/HeapAPI.h:557:19
    #2 0xaaaae8e6fa6c in JS::GCPolicy<JS::Value>::isValid(JS::Value const&) dist/include/js/Value.h:1126:34
    #3 0xaaaae8e6fa6c in JS::MutableHandle<JS::Value>::set(JS::Value const&) dist/include/js/RootingAPI.h:691:5
    #4 0xaaaae982d464 in js::jit::DoTypeMonitorFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICTypeMonitor_Fallback*, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) js/src/jit/BaselineIC.cpp:1274:7
    #5 0xffbcaf69f18  (<unknown module>)

This seems to reproduce only on ARM64.

Comment 1

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 2

[Chris Fallin [:cfallin]]

Attachment: Bug 1657888: Cranelift Wasm backend: zero-extend i32 args as well as returns. r=jseward

The Baldrdash (SpiderMonkey-to-Cranelift) glue layer was properly
setting the argument extension mode for 32-bit return values, so that
the high bits were zeroed, but it was not correctly setting this for
32-bit arguments. This matters when generated Wasm code calls back into
JS or native code; it must zero-extend the value before passing it to
the callee.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a50bfcf246e3
Cranelift Wasm backend: zero-extend i32 args as well as returns. r=jseward

Comment 4

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/a50bfcf246e3