1670983 - Crash in [@ js::jit::MacroAssembler::callWithABI]

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect, P1)

Description

[Kevin Brosnan [Ex-Mozilla]]

Crash report: https://crash-stats.mozilla.org/report/index/50ee9ef3-0e0d-484f-9045-93c750201013

Reason: SIGSEGV /SEGV_MAPERR

Top 10 frames of crashing thread:

0 libxul.so js::jit::MacroAssembler::callWithABI js/src/jit/MacroAssembler.cpp:3174
1 libxul.so js::jit::CodeGenerator::visitSoftUDivOrMod js/src/jit/arm/CodeGenerator-arm.cpp:2264
2 libxul.so js::jit::CodeGenerator::generateBody js/src/jit/CodeGenerator.cpp:7299
3 libxul.so js::jit::CodeGenerator::generateWasm js/src/jit/CodeGenerator.cpp:11328
4 libxul.so js::wasm::IonCompileFunctions js/src/wasm/WasmIonCompile.cpp:5458
5 libxul.so ExecuteCompileTask js/src/wasm/WasmGenerator.cpp:760
6 libxul.so js::wasm::ModuleGenerator::locallyCompileCurrentTask js/src/wasm/WasmGenerator.cpp:822
7 libxul.so js::wasm::ModuleGenerator::finishFuncDefs js/src/wasm/WasmGenerator.cpp:960
8 libxul.so js::wasm::CompileStreaming js/src/wasm/WasmCompile.cpp:752
9 libxul.so CompileStreamTask::execute js/src/wasm/WasmJS.cpp:4007

Comment 1

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Crashing line got added in bug 1639153. Dmitry, does this only get reported now due to this change or is it an actual regression from it?

Comment 2

[Lars T Hansen [:lth]]

Dmitry's on PTO for the next two weeks, I'll take a look.

Comment 3

[Lars T Hansen [:lth]]

Hm, soft div/mod on ARM called from Ion... I thought for sure that was not a supported configuration for wasm... No matter. Bug 1639153 regressed this, because it requires the Tls register to be threaded through runtime calls. It is not done so for soft div/mod. I can repro locally; it will be my preference to try to fix this, I may choose to do so by disabling wasm on soft-idiv ARMv7 devices but we'll see.

Comment 4

[Lars T Hansen [:lth]]

Test case div.js:

new WebAssembly.Module(wasmTextToBinary(`
(module
  (func (export "f") (param i32 i32) (result i32)
    (i32.div_s (local.get 0) (local.get 1))))
`))

Run like this on ARM simulator: ARMHWCAP=armv7,vfp,vfpv3 dist/bin/js --wasm-compiler=ion ~/moz/div.js

Comment 5

[Lars T Hansen [:lth]]

There are multiple locations that have this problem: soft signed div, soft mod, soft unsigned div.

Comment 6

[Lars T Hansen [:lth]]

Attachment: Bug 1670983 - Preserve Tls register across callouts to soft div/mod. r?nbp

Soft div/mod are supported on ARMv7 with Ion, and the callouts need to
preserve the Tls register and pass the Tls register offset to
callWithABI.

The introduced code follows the pattern used elsewhere in the file:
push the Tls before setting up the call and record its frame depth;
pass the frame offset to callWithABI; pop the Tls after the call.
Passes all tests on simulator.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5ec01259d453
Preserve Tls register across callouts to soft div/mod. r=nbp

Comment 8

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/5ec01259d453

Comment 9

[Dmitry Bezhetskov]

iiuc we are done here