1832604 - UndefinedBehaviorSanitizer: ILL SkOpts_skx.cpp in __llvm_gcov_reset

Status: RESOLVED FIXED

(Testing :: Code Coverage, defect)

Description

[Jason Kratzer [:jkratzer]]

I'm seeing the following crash on mozilla-central rev 625c1ea4c73b built with --coverage --enable-fuzzing using . Marking as s-s just due to the SIGILL.

=159926==ERROR: UndefinedBehaviorSanitizer: ILL on unknown address 0x7fe63ceca59f (pc 0x7fe63ceca59f bp 0x000000027060 sp 0x7fe589483678 T159926)
    #0 0x7fe63ceca59f in __llvm_gcov_reset SkOpts_skx.cpp
    #1 0x7fe644d01fa1 in __gcov_fork GCDAProfiling.c
    #2 0x7fe63595f36f in base::LaunchApp(std::vector<std::string, std::allocator<std::string>> const&, base::LaunchOptions const&, int*) /builds/worker/checkouts/gecko/ipc/chromium/src/base/process_util_linux.cc:269:71
    #3 0x7fe635a378ae in mozilla::ipc::PosixProcessLauncher::DoLaunch() /builds/worker/checkouts/gecko/ipc/glue/GeckoChildProcessHost.cpp:1343:7
    #4 0x7fe635a35710 in mozilla::ipc::BaseProcessLauncher::PerformAsyncLaunch() /builds/worker/checkouts/gecko/ipc/glue/GeckoChildProcessHost.cpp:1079:10
    #5 0x7fe635a55618 in operator()<> /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1164:18
    #6 0x7fe635a55618 in __invoke_impl<RefPtr<mozilla::MozPromise<mozilla::ipc::LaunchResults, mozilla::ipc::LaunchError, true> >, (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1163:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7/../../../../include/c++/7/bits/invoke.h:60:14
    #7 0x7fe635a55618 in __invoke<(lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1163:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7/../../../../include/c++/7/bits/invoke.h:95:14
    #8 0x7fe635a55618 in __apply_impl<(lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1163:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7/../../../../include/c++/7/tuple:1662:14
    #9 0x7fe635a55618 in apply<(lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1163:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7/../../../../include/c++/7/tuple:1671:14
    #10 0x7fe635a55618 in apply<mozilla::ipc::BaseProcessLauncher, RefPtr<mozilla::MozPromise<mozilla::ipc::LaunchResults, mozilla::ipc::LaunchError, true> > (mozilla::ipc::BaseProcessLauncher::*)()> /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1162:12
    #11 0x7fe635a55618 in Invoke /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1569:47
    #12 0x7fe635a55618 in mozilla::detail::ProxyRunnable<mozilla::MozPromise<mozilla::ipc::LaunchResults, mozilla::ipc::LaunchError, true>, RefPtr<mozilla::MozPromise<mozilla::ipc::LaunchResults, mozilla::ipc::LaunchError, true>> (mozilla::ipc::BaseProcessLauncher::*)(), mozilla::ipc::BaseProcessLauncher>::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1589:42
    #13 0x7fe634a24637 in mozilla::TaskQueue::Runner::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskQueue.cpp:259:20
    #14 0x7fe634a3a4e5 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1233:16
    #15 0x7fe634a4067e in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10
    #16 0x7fe635a82cf3 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:330:5
    #17 0x7fe63596c167 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10
    #18 0x7fe63596c167 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
    #19 0x7fe63596c167 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
    #20 0x7fe634a35298 in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:391:10
    #21 0x7fe65307b1db in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
    #22 0x7fe652a94b42 in start_thread nptl/pthread_create.c:442:8
    #23 0x7fe652b269ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: ILL SkOpts_skx.cpp in __llvm_gcov_reset

Comment 1

[Marco Castelluccio [:marco]]

Is this only reproducible in coverage builds? If so, it doesn't have to be hidden as a security bug.

Comment 2

[Jason Kratzer [:jkratzer]]

Yes, it's only on coverage builds. I don't have the ability to remove the security flag.

Comment 3

[Jason Kratzer [:jkratzer]]

This bisects back to https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1e648bd9608aa1a18387d381a728b512237a1efe&tochange=188e637999312557a7a57121b45abfb1afbd34ea

Comment 4

[Jason Kratzer [:jkratzer]]

:lsalzman, any idea what might cause this? This bisects back to your changes in bug 1821512.

Comment 5

[Lee Salzman [:lsalzman]]

The traceback is pretty vague and nonspecific. I would need some kind of real test case to effectively debug this?

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1821512

Comment 7

[Jason Kratzer [:jkratzer]]

This is a startup crash. I can probably get you a pernosco session for it.

Comment 8

[Jason Kratzer [:jkratzer]]

So it looks like this is caused by the SSE flags defined here.

My local machine's CPU doesn't support AVX-512. My question is, why is this only crashing on coverage builds?

Comment 9

[Jesse Schwartzentruber (:truber)]

It looks like the same flags are applied to the source coverage instrumentation (ie. __llvm_gcov_reset, which is called at fork).

0000000015a414f0 <__llvm_gcov_reset>:
15a414f0: 48 c7 05 95 e9 19 0e 00 00 00 00      movq    $0x0, 0xe19e995(%rip) # 0x23bdfe90 <__llvm_gcov_ctr>
15a414fb: c5 f8 57 c0                   vxorps  %xmm0, %xmm0, %xmm0
15a414ff: 62 f1 7c 48 11 05 97 e9 19 0e vmovups %zmm0, 0xe19e997(%rip)  # 0x23bdfea0 <__llvm_gcov_ctr.1>
15a41509: 62 f1 7c 48 11 05 cd e9 19 0e vmovups %zmm0, 0xe19e9cd(%rip)  # 0x23bdfee0 <__llvm_gcov_ctr.1+0x40>

vs.

0000000015a42050 <__llvm_gcov_reset>:
15a42050: 48 c7 05 cd e6 19 0e 00 00 00 00      movq    $0x0, 0xe19e6cd(%rip) # 0x23be0728 <__llvm_gcov_ctr>
15a4205b: 0f 57 c0                      xorps   %xmm0, %xmm0
15a4205e: 0f 29 05 cb e6 19 0e          movaps  %xmm0, 0xe19e6cb(%rip)  # 0x23be0730 <__llvm_gcov_ctr.1>
15a42065: 0f 29 05 d4 e6 19 0e          movaps  %xmm0, 0xe19e6d4(%rip)  # 0x23be0740 <__llvm_gcov_ctr.1+0x10>

Comment 10

[Jason Kratzer [:jkratzer]]

Attachment: Bug 1832604 - Disable AVX512 instructions on coverage builds. r=lsalzman

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/48788df052ae
Disable AVX512 instructions on coverage builds. r=lsalzman

Comment 12

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/48788df052ae

Comment 13

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:jkratzer, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox114 to wontfix.

For more information, please visit BugBot documentation.