UndefinedBehaviorSanitizer: ILL SkOpts_skx.cpp in __llvm_gcov_reset
Categories
(Testing :: Code Coverage, defect)
Tracking
(firefox-esr102 unaffected, firefox113 unaffected, firefox114 wontfix, firefox115 fixed)
Tracking | Status | |
---|---|---|
firefox-esr102 | --- | unaffected |
firefox113 | --- | unaffected |
firefox114 | --- | wontfix |
firefox115 | --- | fixed |
People
(Reporter: jkratzer, Assigned: jkratzer)
References
(Regression)
Details
(Keywords: regression, Whiteboard: [fuzzblocker])
Attachments
(1 file)
I'm seeing the following crash on mozilla-central rev 625c1ea4c73b built with --coverage --enable-fuzzing
using . Marking as s-s just due to the SIGILL.
=159926==ERROR: UndefinedBehaviorSanitizer: ILL on unknown address 0x7fe63ceca59f (pc 0x7fe63ceca59f bp 0x000000027060 sp 0x7fe589483678 T159926)
#0 0x7fe63ceca59f in __llvm_gcov_reset SkOpts_skx.cpp
#1 0x7fe644d01fa1 in __gcov_fork GCDAProfiling.c
#2 0x7fe63595f36f in base::LaunchApp(std::vector<std::string, std::allocator<std::string>> const&, base::LaunchOptions const&, int*) /builds/worker/checkouts/gecko/ipc/chromium/src/base/process_util_linux.cc:269:71
#3 0x7fe635a378ae in mozilla::ipc::PosixProcessLauncher::DoLaunch() /builds/worker/checkouts/gecko/ipc/glue/GeckoChildProcessHost.cpp:1343:7
#4 0x7fe635a35710 in mozilla::ipc::BaseProcessLauncher::PerformAsyncLaunch() /builds/worker/checkouts/gecko/ipc/glue/GeckoChildProcessHost.cpp:1079:10
#5 0x7fe635a55618 in operator()<> /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1164:18
#6 0x7fe635a55618 in __invoke_impl<RefPtr<mozilla::MozPromise<mozilla::ipc::LaunchResults, mozilla::ipc::LaunchError, true> >, (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1163:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7/../../../../include/c++/7/bits/invoke.h:60:14
#7 0x7fe635a55618 in __invoke<(lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1163:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7/../../../../include/c++/7/bits/invoke.h:95:14
#8 0x7fe635a55618 in __apply_impl<(lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1163:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7/../../../../include/c++/7/tuple:1662:14
#9 0x7fe635a55618 in apply<(lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1163:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7/../../../../include/c++/7/tuple:1671:14
#10 0x7fe635a55618 in apply<mozilla::ipc::BaseProcessLauncher, RefPtr<mozilla::MozPromise<mozilla::ipc::LaunchResults, mozilla::ipc::LaunchError, true> > (mozilla::ipc::BaseProcessLauncher::*)()> /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1162:12
#11 0x7fe635a55618 in Invoke /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1569:47
#12 0x7fe635a55618 in mozilla::detail::ProxyRunnable<mozilla::MozPromise<mozilla::ipc::LaunchResults, mozilla::ipc::LaunchError, true>, RefPtr<mozilla::MozPromise<mozilla::ipc::LaunchResults, mozilla::ipc::LaunchError, true>> (mozilla::ipc::BaseProcessLauncher::*)(), mozilla::ipc::BaseProcessLauncher>::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1589:42
#13 0x7fe634a24637 in mozilla::TaskQueue::Runner::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskQueue.cpp:259:20
#14 0x7fe634a3a4e5 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1233:16
#15 0x7fe634a4067e in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10
#16 0x7fe635a82cf3 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:330:5
#17 0x7fe63596c167 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10
#18 0x7fe63596c167 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#19 0x7fe63596c167 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#20 0x7fe634a35298 in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:391:10
#21 0x7fe65307b1db in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
#22 0x7fe652a94b42 in start_thread nptl/pthread_create.c:442:8
#23 0x7fe652b269ff misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: ILL SkOpts_skx.cpp in __llvm_gcov_reset
Comment 1•1 years ago
|
||
Is this only reproducible in coverage builds? If so, it doesn't have to be hidden as a security bug.
Assignee | ||
Comment 2•1 years ago
|
||
Yes, it's only on coverage builds. I don't have the ability to remove the security flag.
Assignee | ||
Comment 3•1 years ago
|
||
Assignee | ||
Comment 4•1 years ago
|
||
:lsalzman, any idea what might cause this? This bisects back to your changes in bug 1821512.
Comment 5•1 years ago
|
||
The traceback is pretty vague and nonspecific. I would need some kind of real test case to effectively debug this?
Comment 6•1 years ago
|
||
Set release status flags based on info from the regressing bug 1821512
Assignee | ||
Comment 7•1 years ago
|
||
This is a startup crash. I can probably get you a pernosco session for it.
Assignee | ||
Comment 8•1 year ago
|
||
So it looks like this is caused by the SSE flags defined here.
My local machine's CPU doesn't support AVX-512. My question is, why is this only crashing on coverage builds?
Comment 9•1 year ago
|
||
It looks like the same flags are applied to the source coverage instrumentation (ie. __llvm_gcov_reset
, which is called at fork).
0000000015a414f0 <__llvm_gcov_reset>:
15a414f0: 48 c7 05 95 e9 19 0e 00 00 00 00 movq $0x0, 0xe19e995(%rip) # 0x23bdfe90 <__llvm_gcov_ctr>
15a414fb: c5 f8 57 c0 vxorps %xmm0, %xmm0, %xmm0
15a414ff: 62 f1 7c 48 11 05 97 e9 19 0e vmovups %zmm0, 0xe19e997(%rip) # 0x23bdfea0 <__llvm_gcov_ctr.1>
15a41509: 62 f1 7c 48 11 05 cd e9 19 0e vmovups %zmm0, 0xe19e9cd(%rip) # 0x23bdfee0 <__llvm_gcov_ctr.1+0x40>
vs.
0000000015a42050 <__llvm_gcov_reset>:
15a42050: 48 c7 05 cd e6 19 0e 00 00 00 00 movq $0x0, 0xe19e6cd(%rip) # 0x23be0728 <__llvm_gcov_ctr>
15a4205b: 0f 57 c0 xorps %xmm0, %xmm0
15a4205e: 0f 29 05 cb e6 19 0e movaps %xmm0, 0xe19e6cb(%rip) # 0x23be0730 <__llvm_gcov_ctr.1>
15a42065: 0f 29 05 d4 e6 19 0e movaps %xmm0, 0xe19e6d4(%rip) # 0x23be0740 <__llvm_gcov_ctr.1+0x10>
Assignee | ||
Comment 10•1 year ago
|
||
Updated•1 year ago
|
Comment 11•1 year ago
|
||
Comment 12•1 year ago
|
||
bugherder |
Comment 13•1 year ago
|
||
The patch landed in nightly and beta is affected.
:jkratzer, is this bug important enough to require an uplift?
- If yes, please nominate the patch for beta approval.
- If no, please set
status-firefox114
towontfix
.
For more information, please visit BugBot documentation.
Assignee | ||
Updated•1 year ago
|
Description
•