1673208 - WASM tab crashes on mips64el

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect, P5)

Description

[vinceying113]

User Agent: Mozilla/5.0 (X11; Linux mips64; rv:78.0) Gecko/20100101 Firefox/78.0

Steps to reproduce:

Visit pages that use WebAssembly. Reproduced on these pages:
https://evgeny-nadymov.github.io/telegram-react/
https://pspdfkit.com/webassembly-benchmark/

Mozilla/5.0 (X11; Linux mips64; rv:78.0) Gecko/20100101 Firefox/78.0
The firefox-esr package from Debian stable

Actual results:

The tab will crash. Not immediately, but consistently within the first minute.

javascript.options.wasm_ionjit = False appears to mitigate the problem.

Expected results:

Works fine on other architectures.

Comment 1

[vinceying113]

Another example that will either crash the tab or generate an error in the app almost immediately:
https://blazjobboard.azurewebsites.net/

javascript.options.wasm_ionjit = False works without issue.

Comment 2

[Daniel Bodea [:danibodea]]

Can you please go to "about:crashes" page, open the crashes with the time and date of when this issue reproduced and paste the links here?

I have installed canonical Firefox ESR v78.4.0 on Kubuntu 20 and opened the links above, but no crash was observed.
Can you retry your steps in a newly created profile, please? (https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Multiple_profiles)

Thank you for your contribution!

Comment 3

[vinceying113]

The Debian build of Firefox I'm using doesn't have "about:crashes", looks like it's a build time option?

Are you on mips64? The reason I ask is because you said you're using Kubuntu 20. From what I can tell, there is no Ubuntu/Kubuntu for mips64. Also I don't believe there is a canonical build of Firefox for mips64 from either Ubuntu/Kubuntu or Mozilla.

I agree that this bug is not reproducible on other architectures. All of the sites listed work fine on amd64 or arm64. The crash is mips64el specific.

Comment 4

[Daniel Bodea [:danibodea]]

No, I am not using mips64 and we don't have devices with this architecture.
It may be safe to assume that this is an issue specific to mips64 processors.
Unfortunately, I cannot confirm this issue, but I can set its component to (Core) JavaScript: WebAssembly and let someone more technical take over.

Comment 5

[Lars T Hansen [:lth]]

Thanks for the report. mips64 is unsupported by Mozilla but i've cc'd a person who i believe helps maintain that port.

Comment 6

[Zhao Jiazhong]

Thanks for your information, I reproduced it on my machine, and I will try to find out the bug.

Comment 7

[janet [:janet]]

We're dropping the severity down to an S3 to match the criteria defined here: https://wiki.mozilla.org/BMO/UserGuide/BugFields#bug_severity.

Comment 8

[Zhao Jiazhong]

Attachment: Bug 1673208 - [MIPS] Handle non-register input in visitWasmSelect. r=lth

The falseExpr of LWasmSelect may not be register value on mips,
we shouldn't just use it as a register.

Comment 9

[Zhao Jiazhong]

I think the bug is in visitWasmSelect, and with the patch above, ff76 didn't crash on those pages.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ab996502ad4f
[MIPS] Handle non-register input in visitWasmSelect. r=lth

Comment 11

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/ab996502ad4f

Comment 12

[Zhao Jiazhong]

Comment on attachment 9185921 [details]
Bug 1673208 - [MIPS] Handle non-register input in visitWasmSelect. r=lth

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: Fix a bug that caused some wasm pages crash on mips machines, and won't affect other platforms.
• User impact if declined: Some wasm pages may crash on mips machines.
• Fix Landed on Version: firefox84
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This change is quite small, and only affects mips platform.
• String or UUID changes made by this patch:

Comment 13

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9185921 [details]
Bug 1673208 - [MIPS] Handle non-register input in visitWasmSelect. r=lth

Approved for 78.5esr.

Comment 14

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr78/rev/8dad9d78dd0f

Comment 15

[vinceying113]

Thank you for fixing the WASM bug. I have upgraded to 78.5esr and am no longer having any problems with WASM. However, I am running into what seems like a similar issue with regular JavaScript.

https://twitter.com/firefox will tab crash within a minute of use (if I start scrolling down it will eventually crash). Disabling javascript.options.baselinejit seems to eliminate the issue, similar to how disabling javascript.options.wasm_ionjit fixed the WASM issue.

Mozilla/5.0 (X11; Linux mips64; rv:78.0) Gecko/20100101 Firefox/78.0

Comment 16

[Lars T Hansen [:lth]]

Please file a new bug for the new problem.