1975932 - Misaligned WASM stack on riscv64

Status: RESOLVED DUPLICATE of bug 1976699

(Core :: JavaScript: WebAssembly, defect, P5)

Description

[Rong Bao [:csmantle]]

Attachment: Listing of failed tests

The current implementation fails to align the stack to WasmStackAlignment, leading to various runtime assertions.

This problem was discovered after debug assertions were unsilenced on riscv64 simulator in bug 1975201. Running jit-test on riscv64 simulator would lead to 450+ MOZ_CRASH(Die), which is fired by ebreak traps. See the attachment for a list of failed tests.

One sample stack trace is as follows:

[28716] Hit MOZ_CRASH(Die) at D:/Workspace/gecko-dev/js/src/jit/riscv64/Simulator-riscv64.cpp:1796
#01: js::jit::Simulator::SoftwareInterrupt (D:\Workspace\gecko-dev\js\src\jit\riscv64\Simulator-riscv64.cpp:1645)
#02: js::jit::Simulator::InstructionDecode (D:\Workspace\gecko-dev\js\src\jit\riscv64\Simulator-riscv64.cpp:1879)
#03: js::jit::Simulator::callInternal (D:\Workspace\gecko-dev\js\src\jit\riscv64\Simulator-riscv64.cpp:4058)
#04: js::jit::Simulator::call (D:\Workspace\gecko-dev\js\src\jit\riscv64\Simulator-riscv64.cpp:4126)
#05: js::jit::EnterBaselineInterpreterAtBranch (D:\Workspace\gecko-dev\js\src\jit\BaselineJIT.cpp:201)
#06: js::Interpret (D:\Workspace\gecko-dev\js\src\vm\Interpreter.cpp:2046)
#07: js::RunScript (D:\Workspace\gecko-dev\js\src\vm\Interpreter.cpp:471)
#08: js::ExecuteKernel (D:\Workspace\gecko-dev\js\src\vm\Interpreter.cpp:866)
#09: js::Execute (D:\Workspace\gecko-dev\js\src\vm\Interpreter.cpp:895)
#10: ExecuteScript (D:\Workspace\gecko-dev\js\src\vm\CompilationAndEvaluation.cpp:601)
#11: JS_ExecuteScript (D:\Workspace\gecko-dev\js\src\vm\CompilationAndEvaluation.cpp:626)
#12: RunFile (D:\Workspace\gecko-dev\js\src\shell\js.cpp:1316)
#13: Process (D:\Workspace\gecko-dev\js\src\shell\js.cpp:2043)
#14: Shell (D:\Workspace\gecko-dev\js\src\shell\js.cpp:12074)
#15: main (D:\Workspace\gecko-dev\js\src\shell\js.cpp:12477)
#16: __scrt_common_main_seh (D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288)
#17: BaseThreadInitThunk[C:\WINDOWS\System32\KERNEL32.DLL +0x2e8d7]
#18: RtlUserThreadStart[C:\WINDOWS\SYSTEM32\ntdll.dll +0x3c34c]
Exit code: 2147483651
FAIL - wasm\memory64\basic.js

This is consistent with the observations in bug 1933206, which described 300+ tests being killed by SIGTRAP generated from native ebreaks.

If WasmStackAlignment is changed from the current 16 to ABIStackAlignment (8, which is not compliant with the standard), most of these failures would vanish.

[12701|    5|    2| 1191] 100% ======================================>| 374.5s
FAILURES:
    --fast-warmup arguments\inline-arguments-oob-negative-index-2.js
    bigint\bigint-inc-64.js
    --spectre-mitigations=on ion\bug1433496.js
TIMEOUTS:
    bug1852218.js
    ion\pow-base-power-of-two.js

It is not yet determined whether this issue exists on other platforms with WasmStackAlignment > ABIStackAlignment. The reason why no errors pop up on simulators may be each simulator's counterpart of bug 1975201.

Comment 1

[Rong Bao [:csmantle]]

Marking this as blocking bug 1933206.

Comment 2

[Rong Bao [:csmantle]]

I think this issue is rooted in bug 1976699. We should respect ABI stack alignment requirements upon entry to every function, not just the WASM stack. :rhunt, do you think we should mark this as a duplicate of bug 1976699?

Comment 3

[Jan de Mooij [:jandem]]

Is this fixed by your changes in bug 1976699?

Comment 4

[Rong Bao [:csmantle]]

(In reply to Jan de Mooij [:jandem] from comment #3)

Is this fixed by your changes in bug 1976699?

Yes, these tests are passing now.

Comment 5

[Jan de Mooij [:jandem]]

Great, let's close this then.