925305 - Assertion failure: false (MOZ_ASSUME_UNREACHABLE(Modified registers between VM call and OsiPoint)), at jit/shared/CodeGenerator-shared.cpp:532

Status: VERIFIED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision aa986b6ce882 (run with --fuzzing-safe --ion-eager):


enableOsiPointRegisterChecks();
function testFloat32SetElemIC(a) {
  for (var i = 0; i < a.length; i++) {
    var r = Math.fround(Math.random());
    a[i] = r;
  }
}
testFloat32SetElemIC(new Array(2048));
testFloat32SetElemIC(new Float64Array(2048));

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Jan de Mooij [:jandem]]

This looks like a float32 + setelem IC issue. Can you take a look? Thanks :)

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/ed91189f940e
user:        Brian Hackett
date:        Wed Sep 18 09:43:21 2013 -0600
summary:     Bug 917441 - Remove dependence of IonBuilder on ScriptAnalysis, r=jandem.

This iteration took 418.712 seconds to run.

Comment 4

[Nicolas B. Pierron [:nbp]]

Add sec-critical security rating as this assertion implies that one register is mutated and the mutation can be observed with a try-catch.

(In reply to Jan de Mooij [:jandem] from comment #2)
> This looks like a float32 + setelem IC issue. Can you take a look? Thanks :)

I guess the easiest would be to add a NoFloatPolicy on the MSetElementCache value operand.

Comment 5

[Shu-yu Guo [:shu]]

Attachment: Use ScratchFloatReg when converting float32->double for callVM. (r=?)

Shouldn't have been doing conversion in place. So far this hasn't been a
problem because all relevant uses of pushArg on float32s have been between
saveLive/restoreLive pairs, which made the in-place conversion not observable.
The OSI point checker is installed in callVM though, in between saveLive and
restoreLive, and so was able to observe this.

Comment 6

[Shu-yu Guo [:shu]]

Apparently bzexport doesn't clear needinfo

Comment 7

[Shu-yu Guo [:shu]]

Attachment: Use ScratchFloatReg when converting float32->double for callVM. (r=?)

Fix the other place where we were converting in place.

Comment 8

[Sean Stangl [:sstangl]]

Comment on attachment 815694 [details] [diff] [review]
Use ScratchFloatReg when converting float32->double for callVM. (r=?)

Review of attachment 815694 [details] [diff] [review]:
-----------------------------------------------------------------

Stealing review on shu's request.

Comment 9

[Shu-yu Guo [:shu]]

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/f422b59826c1

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/f422b59826c1

Comment 11

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 12

[David Chan [:dchan]]

Cleaning up list of security bugs for b2g18. This bug doesn't need to be backported either due to it affecting a later version of Fx or another reason.