1987333 - MacroAssembler-riscv64: ma_branch fails to fall back to long jumps when offset overflows

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Rong Bao [:csmantle]]

Attachment: program_20250908081209_10DD0727-7754-47A0-B214-4F35E6C615BE_deterministic.js

Running the provided program gives Access Violation (0xC0000005) on Windows and SIGSEGV on Linux:

$ ./obj-x86_64-pc-linux-gnu/dist/bin/js --no-threads --ion-check-range-analysis --ion-extra-checks --baseline-eager --ion-eager --fast-warmup /mnt/d/Workspace/stable_crashes/program_20250908081209_10DD0727-7754-47A0-B214-4F35E6C615BE_deterministic.js
Segmentation fault (core dumped)
$

Checking JitSpew we can see that a Goto fails to produce any native code:

[Codegen] # END   creators: BaselineCompiler::compile/BaselineCompiler::emitBody/op=Pop
[BaselineOp] Compiling op @ 17643: Goto
[Codegen] # BEGIN creators: BaselineCompiler::compile/BaselineCompiler::emitBody/op=Goto
[Codegen] # END   creators: BaselineCompiler::compile/BaselineCompiler::emitBody/op=Goto
[BaselineOp] Compiling op @ 17648: JumpTarget

This is because while MacroAssemblerRiscv64::BranchShortCheck (^1) may return false when it fails to assemble the offset into imm21, the caller doesn't always check its return value (^2, ^3). That causes some far branches to be silently discarded, leading to control flow runaway.

Comment 1

[Rong Bao [:csmantle]]

Attachment: Bug 1987333 - [riscv64] Fall back to long jump when short jump assembly failed in MacroAssemblerRiscv64::ma_branch. r=jandem

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/8875d29890e6
https://hg.mozilla.org/integration/autoland/rev/9b5920dfd94f
[riscv64] Fall back to long jump when short jump assembly failed in MacroAssemblerRiscv64::ma_branch. r=jandem

Comment 3

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/9b5920dfd94f