1875363 - MOZ_CRASH involving disnative

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: debug stack

function f() {};
f();
disnative(f);

(gdb) bt
#0  js::jit::disasm::Decoder::DecodeType3 (this=0xffffa760, instr=0x3b2a5184) at /home/skygentoo/trees/mozilla-central/js/src/jit/arm/disasm/Disasm-arm.cpp:1010
#1  0x58904392 in js::jit::disasm::Decoder::InstructionDecode (this=0xffffa760, instr_ptr=0x3b2a5184 "\323!\231V\004\343", <incomplete sequence \367>)
    at /home/skygentoo/trees/mozilla-central/js/src/jit/arm/disasm/Disasm-arm.cpp:1932
#2  0x588f2112 in js::jit::disasm::Disassembler::InstructionDecode (this=0xffffa7b8, buffer=..., instruction=0x3b2a5184 "\323!\231V\004\343", <incomplete sequence \367>)
    at /home/skygentoo/trees/mozilla-central/js/src/jit/arm/disasm/Disasm-arm.cpp:2007
#3  0x58ab7e7b in js::jit::Disassemble (code=0x3b2a5038 "\004\340-\345\004\260-\345\r\260\240\341\a", length=380, callback=0x581e9ab0 <captureDisasmText(char const*)>)
    at /home/skygentoo/trees/mozilla-central/js/src/jit/Disassemble.cpp:87
#4  0x581c6e67 in DisassembleNative (cx=<optimized out>, argc=1, vp=0xf67ffec8) at /home/skygentoo/trees/mozilla-central/js/src/builtin/TestingFunctions.cpp:1730
#5  0x57d3935b in CallJSNative (cx=0xf7617600, native=0x581c6ac0 <DisassembleNative(JSContext*, unsigned int, JS::Value*)>, reason=js::CallReason::Call, args=...)
    at /home/skygentoo/trees/mozilla-central/js/src/vm/Interpreter.cpp:459
/snip

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/7527c113748d
user:        Jan de Mooij
date:        Tue Jan 03 16:01:13 2023 +0000
summary:     Bug 1808171 part 10 - Add separate JSClass for Debugger.prototype. r=sfink

Run with --fuzzing-safe --no-threads --ion-eager --arm-hwcap=vfp, compile with AR=ar PKG_CONFIG_PATH=/usr/lib/x86_64-linux-gnu/pkgconfig 'CC="clang -msse2 -mfpmath=sse"' 'CXX="clang++ -msse2 -mfpmath=sse"' sh ../configure --host=x86_64-pc-linux-gnu --target=i686-pc-linux --enable-simulator=arm --enable-debug --enable-debug-symbols --with-ccache --disable-bootstrap --enable-gczeal --enable-rust-simd --disable-tests, tested on m-c rev 7527c113748d.

Jan, is bug 1808171 a likely regressor? I highly doubt this is s-s.

Comment 1

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1808171

Comment 2

[Jan de Mooij [:jandem]]

This isn't a regression from bug 1808171.

It's a problem with the ARM disassembler. I think it's getting confused by constant pools and these probably contain values that depend on the binary, ASLR, etc.

Comment 3

[Jan de Mooij [:jandem]]

The ARM disassembler doesn't recognize our constant pool header; it's checking for the V8 format with kConstantPoolMarkerMask etc.

I tried to fix this, but the next issue is that it's hard to display the pool contents without disassembling these bytes, because we decode one instruction at a time...

It's fixable but for now it's probably best to disable disnative for ARM32 with --fuzzing-safe. The disassembler needs more work.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Jan de Mooij [:jandem] from comment #3)

for now it's probably best to disable disnative for ARM32 with --fuzzing-safe.

This works for me!

Comment 5

[Jan de Mooij [:jandem]]

Attachment: Bug 1875363 - Treat disnative as fuzzing-unsafe on ARM32. r?nbp!

The ARM32 disassembler doesn't recognize our constant pool header because it's
checking for the V8 format. Furthermore, because we decode one instruction at a
time, it's not very easy to print the constant pool contents without disassembling.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/350c5c20b4df
Treat disnative as fuzzing-unsafe on ARM32. r=nbp

Comment 7

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/350c5c20b4df