1669003 - Perma [Tier2] js\src\jit-test\tests\wasm\memory-partial-oob-store.js | z:\task_1601721669\src\js\src\jit-test\tests\wasm\memory-partial-oob-store.js:62:17 Error: Assertion failed: got 33, expected 0 (code 3, args "") [0.1 s]

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect, P1)

Description

[Treeherder Bug Filer]

Filed by: nbeleuzu [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer.html#?job_id=317470675&repo=mozilla-central
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/HWpzay2ERuKYEbarNEoBPg/runs/0/artifacts/public/logs/live_backing.log

---

[task 2020-10-03T11:35:41.802Z] TEST-PASS | js\src\jit-test\tests\wasm\memory-cloning.js | Success (code 59, args "--disable-wasm-huge-memory") [0.0 s]
[task 2020-10-03T11:35:41.863Z] z:\task_1601721669\src\js\src\jit-test\tests\wasm\memory-partial-oob-store.js:62:17 Error: Assertion failed: got 33, expected 0
[task 2020-10-03T11:35:41.863Z] 
[task 2020-10-03T11:35:41.863Z] Stack:
[task 2020-10-03T11:35:41.863Z] 
[task 2020-10-03T11:35:41.863Z]   @z:\task_1601721669\src\js\src\jit-test\tests\wasm\memory-partial-oob-store.js:92:24
[task 2020-10-03T11:35:41.863Z] 
[task 2020-10-03T11:35:41.863Z] Exit code: 3
[task 2020-10-03T11:35:41.863Z] FAIL - wasm\memory-partial-oob-store.js
[task 2020-10-03T11:35:41.863Z] TEST-UNEXPECTED-FAIL | js\src\jit-test\tests\wasm\memory-partial-oob-store.js | z:\task_1601721669\src\js\src\jit-test\tests\wasm\memory-partial-oob-store.js:62:17 Error: Assertion failed: got 33, expected 0 (code 3, args "") [0.1 s]
[task 2020-10-03T11:35:41.863Z] INFO exit-status     : 3
[task 2020-10-03T11:35:41.863Z] INFO timed-out       : False
[task 2020-10-03T11:35:41.863Z] INFO stderr         2> z:\task_1601721669\src\js\src\jit-test\tests\wasm\memory-partial-oob-store.js:62:17 Error: Assertion failed: got 33, expected 0
[task 2020-10-03T11:35:41.863Z] INFO stderr         2> Stack:
[task 2020-10-03T11:35:41.863Z] INFO stderr         2> @z:\task_1601721669\src\js\src\jit-test\tests\wasm\memory-partial-oob-store.js:92:24
[task 2020-10-03T11:35:41.948Z] z:\task_1601721669\src\js\src\jit-test\tests\wasm\memory-partial-oob-store.js:62:17 Error: Assertion failed: got 33, expected 0
[task 2020-10-03T11:35:41.948Z] 
[task 2020-10-03T11:35:41.948Z] Stack:
[task 2020-10-03T11:35:41.948Z] 
[task 2020-10-03T11:35:41.948Z]   @z:\task_1601721669\src\js\src\jit-test\tests\wasm\memory-partial-oob-store.js:92:24
[task 2020-10-03T11:35:41.948Z] 
[task 2020-10-03T11:35:41.948Z] Exit code: 3
[task 2020-10-03T11:35:41.948Z] FAIL - wasm\memory-partial-oob-store.js
[task 2020-10-03T11:35:41.948Z] TEST-UNEXPECTED-FAIL | js\src\jit-test\tests\wasm\memory-partial-oob-store.js | z:\task_1601721669\src\js\src\jit-test\tests\wasm\memory-partial-oob-store.js:62:17 Error: Assertion failed: got 33, expected 0 (code 3, args "--ion-eager --ion-offthread-compile=off --more-compartments") [0.1 s]
[task 2020-10-03T11:35:41.948Z] INFO exit-status     : 3
[task 2020-10-03T11:35:41.948Z] INFO timed-out       : False
[task 2020-10-03T11:35:41.948Z] INFO stderr         2> z:\task_1601721669\src\js\src\jit-test\tests\wasm\memory-partial-oob-store.js:62:17 Error: Assertion failed: got 33, expected 0
[task 2020-10-03T11:35:41.948Z] INFO stderr         2> Stack:
[task 2020-10-03T11:35:41.948Z] INFO stderr         2> @z:\task_1601721669\src\js\src\jit-test\tests\wasm\memory-partial-oob-store.js:92:24
[task 2020-10-03T11:35:42.033Z] z:\task_1601721669\src\js\src\jit-test\tests\wasm\memory-partial-oob-store.js:62:17 Error: Assertion failed: got 33, expected 0
[task 2020-10-03T11:35:42.033Z] 
[task 2020-10-03T11:35:42.033Z] Stack:
[task 2020-10-03T11:35:42.033Z] 
[task 2020-10-03T11:35:42.033Z]   @z:\task_1601721669\src\js\src\jit-test\tests\wasm\memory-partial-oob-store.js:92:24
[task 2020-10-03T11:35:42.033Z] 
[task 2020-10-03T11:35:42.033Z] Exit code: 3
[task 2020-10-03T11:35:42.033Z] FAIL - wasm\memory-partial-oob-store.js
[task 2020-10-03T11:35:42.033Z] TEST-UNEXPECTED-FAIL | js\src\jit-test\tests\wasm\memory-partial-oob-store.js | z:\task_1601721669\src\js\src\jit-test\tests\wasm\memory-partial-oob-store.js:62:17 Error: Assertion failed: got 33, expected 0 (code 3, args "--ion-eager --ion-offthread-compile=off --ion-check-range-analysis --ion-extra-checks --no-sse3 --no-threads") [0.1 s]
[task 2020-10-03T11:35:42.033Z] INFO exit-status     : 3
[task 2020-10-03T11:35:42.033Z] INFO timed-out       : False
[task 2020-10-03T11:35:42.033Z] INFO stderr         2> z:\task_1601721669\src\js\src\jit-test\tests\wasm\memory-partial-oob-store.js:62:17 Error: Assertion failed: got 33, expected 0
[task 2020-10-03T11:35:42.033Z] INFO stderr         2> Stack:
[task 2020-10-03T11:35:42.033Z] INFO stderr         2> @z:\task_1601721669\src\js\src\jit-test\tests\wasm\memory-partial-oob-store.js:92:24
[task 2020-10-03T11:35:42.096Z] z:\task_1601721669\src\js\src\jit-test\tests\wasm\memory-partial-oob-store.js:62:17 Error: Assertion failed: got 33, expected 0
[task 2020-10-03T11:35:42.096Z] 
[task 2020-10-03T11:35:42.096Z] Stack:
[task 2020-10-03T11:35:42.096Z] 
[task 2020-10-03T11:35:42.096Z]   @z:\task_1601721669\src\js\src\jit-test\tests\wasm\memory-partial-oob-store.js:92:24
[task 2020-10-03T11:35:42.096Z] 
[task 2020-10-03T11:35:42.096Z] Exit code: 3
[task 2020-10-03T11:35:42.096Z] FAIL - wasm\memory-partial-oob-store.js```

Comment 1

[Lars T Hansen [:lth]]

OK, that is really surprising. I will look into it first thing on monday.

Comment 2

[Lars T Hansen [:lth]]

Also on 32-bit Linux, but not on 64-bit, not even with huge memory disabled.

Comment 3

[Lars T Hansen [:lth]]

64-bit integer stores on x86 and ARMv7 incorrectly store the low word before the high word, thus not hitting the guard page until the second word, thus may store partial data. MIPS32 gets it right. Not a security problem per se, since there's not a sandbox breach, though it's annoying.

Comment 4

[Intermittent Failures Robot]

12 failures in 4195 pushes (0.003 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-central: 12

Platform breakdown:

• windows2012-32: 12

For more details, see:
https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?bug=1669003&startday=2020-09-28&endday=2020-10-04&tree=all

Comment 5

[Lars T Hansen [:lth]]

Attachment: Bug 1669003 - Write high word before low when storing I64 on x86 and ARMv7. r?jseward

When storing an i64 on a 32-bit system, the high word must be stored
before the low word so that the guard-page OOB check can trigger
before any data are written.

The problem affects x86 and ARMv7 (though not MIPS32). This patch
fixes both platforms, but note ARMv7 needs additional work to deal
with some unaligned stores, see bug 1666747.

Comment 6

[Julian Seward [:jseward]]

Note that there's an inherent ambiguity here in the phrase "high word", which is
made harmless by the fact that both x86 and ARMv7 are little-endian: "high word"
could either mean the high-addressed word in memory, or the higher-significance
word, abstractly speaking. On a little-endian target these are the same, but not for
big endians.

Comment 7

[Lars T Hansen [:lth]]

Mm. "High addressed". Although we (explicitly) have no JIT support for any big-endian architectures.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/04fdcc8532d8
Write high word before low when storing I64 on x86 and ARMv7.  r=jseward

Comment 9

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/04fdcc8532d8

Comment 10

[Intermittent Failures Robot]

3 failures in 4130 pushes (0.001 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-central: 3

Platform breakdown:

• windows2012-32: 3

For more details, see:
https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?bug=1669003&startday=2020-10-05&endday=2020-10-11&tree=all