1666142 - [warp] Crash [@ ??] with GC

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20200918-ab7d302fd318 (debug build, run with --fuzzing-safe --cpu-count=2 --ion-offthread-compile=off --more-compartments --warp --fast-warmup):

function testWithIntlConstructors(f) {
  ["PluralRules", "RelativeTimeFormat", "ListFormat"].forEach(function(constructor) {
    var Constructor = Intl[constructor];
      f(Constructor);
  });
}
function getLocaleSupportInfo(Constructor) {
  var languages = ["zh", "es", "en", "hi", "ur", "ar", "ja", "pa"];
  var scripts = ["Latn", "Hans", "Deva", "Arab", "Jpan", "Hant", "Guru"];
  var allTags = [];
  for (i = 0; i < languages.length; i++) {
    language = languages[i];
    for (j = 0; j < scripts.length; j++) {
      script = scripts[j];
      allTags.push(language + "-" + script);
    }
  }
  for (i = 0; i < allTags.length; i++) {
    var request = allTags[i];
    var result = new Constructor([request], {localeMatcher: "lookup"}).resolvedOptions().locale;
  };
}
gczeal(14);
testWithIntlConstructors(function (Constructor) {
    var info = getLocaleSupportInfo(Constructor);
});

Backtrace:

received signal SIGSEGV, Segmentation fault.
0x00000138c16e5b00 in ?? ()
#0  0x00000138c16e5b00 in ?? ()
#1  0x00000138c1735bd2 in ?? ()
#2  0x0000000000002042 in ?? ()
#3  0x00003d2d1e8a2881 in ?? ()
#4  0x0000000000000000 in ?? ()
rax	0x0	0
rbx	0x7ffff6027000	140737320742912
rcx	0x2042	8258
rdx	0x0	0
rsi	0x138c16e5b00	1343275031296
rdi	0x7ffff58e9718	140737313150744
rbp	0x7fffffffa300	140737488331520
rsp	0x7fffffffa2d0	140737488331472
r8	0x8	8
r9	0x299490a00008	45718058303496
r10	0x55555842e8d8	93825041361112
r11	0x1fffc	131068
r12	0xfffe3d2d1e8b3200	-495685958159872
r13	0xfffe3d2d1e8b3200	-495685958159872
r14	0x299490a027f0	45718058313712
r15	0xfffb3d2d1e8c60e0	-1340110888214304
rip	0x138c16e5b00	1343275031296
=> 0x138c16e5b00:	in     (%dx),%eax
   0x138c16e5b01:	in     (%dx),%eax

Comment 1

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 2

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Unable to reproduce bug using the following builds:

mozilla-central 20200919212721-ab4f6932ea8a
mozilla-central 20200918211411-ab7d302fd318
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.

Comment 3

[Jan de Mooij [:jandem]]

Good find! Iain, it looks like CreateThisFromIC ends up discarding the Baseline code of the callee so after that we restore codeReg and things go bad..

Test below crashes with --warp --fast-warmup --no-threads.

function f() {
  for (var i = 0; i < 100; i++) {
    new Intl.PluralRules(["en-Latn"], {localeMatcher: "lookup"}).resolvedOptions();
  };
}
gczeal(14);
f();

Comment 4

[Iain Ireland [:iain]]

Ugh, this is a mess to fix.

We don't know until after making the VM call to CreateThisFromIC whether we've discarded the baseline code. To make a VM call, we need an AutoStubFrame, which requires the stack to be empty, which means that we must be done using the input operands. This seems to rule out using a normal FailurePath.

It's a bit awkward, but I think the best solution is to check after calling CreateThis whether we have a baseline script, and fall back to a non-inlined call if we don't. This requires a bit of a dance in the arguments rectifier.

Patch coming tomorrow.

Comment 5

[Jan de Mooij [:jandem]]

If it gets too messy, another option is for CreateThisFromIC to preserve JIT code in the Zone (or for the callee script). No great options here..

Comment 6

[Iain Ireland [:iain]]

Attachment: Bug 1666142: Fix CreateThis r=jandem

I will land a testcase separately once I manage to write something that triggers the arguments rectifier code and doesn't use Intl.

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/integration/autoland/rev/8aad0c5e497d00bbeb71cc85407d13858403264b
https://hg.mozilla.org/mozilla-central/rev/8aad0c5e497d

Comment 8

[Iain Ireland [:iain]]

Attachment: Bug 1666142: Add tests r=jandem

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Add tests r=jandem
https://hg.mozilla.org/integration/autoland/rev/df04cbc0d324a8fbb60aa695ba28c0ccb813b2bf
https://hg.mozilla.org/mozilla-central/rev/df04cbc0d324