1876137 - MOZ_ASSERT for some wasm shuffle

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect, P1)

Description

[Yury Delendik (:yury)]

Ryan ran into https://searchfox.org/mozilla-central/source/js/src/jit/ShuffleAnalysis.cpp#395 assert when loading PhotoShop in a debug build.

(const js::jit::SimdConstant::I8x16 &) lanes = <no value available>: {
  [0] = '\0'
  [1] = '\x02'
  [2] = '\x04'
  [3] = '\x06'
  [4] = '\b'
  [5] = '\n'
  [6] = '\f'
  [7] = '\x0e'
  [8] = '\x10'
  [9] = '\x12'
  [10] = '\x14'
  [11] = '\x16'
  [12] = '\x18'
  [13] = '\x1a'
  [14] = '\x1c'
  [15] = '\x1e'
}

Link to repro: https://photoshop.adobe.com/id/tmp:6zebda?learnid=7b050fa34872

Comment 1

[Yury Delendik (:yury)]

Attachment: test.js

Comment 2

[Yury Delendik (:yury)]

Attachment: Bug 1876137 - Properly match zero-extend shuffle. r?jseward

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1870148

Comment 4

[Yury Delendik (:yury)]

Attachment: Bug 1876137 - Properly match zero-extend shuffle. r?jseward

Original Revision: https://phabricator.services.mozilla.com/D199386

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9879c887ba03
Properly match zero-extend shuffle. r=jseward

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/9879c887ba03

Comment 7

[Yury Delendik (:yury)]

Comment on attachment 9376064 [details]
Bug 1876137 - Properly match zero-extend shuffle. r?jseward

Beta/Release Uplift Approval Request

• User impact if declined: Incorrect behavior in some wasm programs or MOZ_CRASH().
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): isolated to specific functionality in wasm + ion
• String changes made/needed:
• Is Android affected?: Unknown

Comment 8

[Christian Holler (:decoder)]

Yury, does this have any kind of security impact?

Comment 9

[Yury Delendik (:yury)]

(In reply to Christian Holler (:decoder) from comment #8)

Yury, does this have any kind of security impact?

Just as mentioned in user impact for beta uplift request: incorrect program results or explicit MOZ_CRASH().

Comment 10

[Pascal Chevrel:pascalc]

Comment on attachment 9376064 [details]
Bug 1876137 - Properly match zero-extend shuffle. r?jseward

Approved for 123 beta 3, thanks.

Comment 11

[Pascal Chevrel:pascalc]

https://hg.mozilla.org/releases/mozilla-beta/rev/7e7ff82e4b5d