std_example jit test broken with latest nightly

[bjorn3]

It depends on the exact ASLR seed, but I have seen jumps into libLLVM.so and jumps to unmapped memory. So far only checked on arm64.

[bjorn3]

A couple of gdb helpers I used while trying to debug this:

import gdb

def jitmap_raw():
    pid = gdb.selected_inferior().pid
    jitmap_file = open("/tmp/perf-%d.map" % (pid,), "r")
    jitmap = jitmap_file.read()
    jitmap_file.close()
    return jitmap

def jit_functions():
    jitmap = jitmap_raw()

    functions = []
    for line in jitmap.strip().split("\n"):
        [addr, size, name] = line.split(" ")
        functions.append((int(addr, 16), int(size, 16), name))

    return functions

class FunctionEnterBreakpoint(gdb.Breakpoint):
    def __init__(self, spec, name):
        self._function_name = name
        super(FunctionEnterBreakpoint, self).__init__(spec, internal=True)

    @staticmethod
    def stack_depth():
        frame = gdb.newest_frame()
        while frame.older():
            frame = frame.older()
        return frame.level()

    def stop(self):
        print('  ' * self.stack_depth() + self._function_name)
        return False

class JitTraceCommand(gdb.Command):
    def __init__(self):
        super(JitTraceCommand, self).__init__(
            'jit-trace',
            gdb.COMMAND_TRACEPOINTS,
            gdb.COMPLETE_NONE,
            True)

    def invoke(self, arg, from_tty):
        for (addr, size, name) in jit_functions():
            FunctionEnterBreakpoint("*%d" % (addr,), name)

JitTraceCommand()

class JitDecorator(gdb.FrameDecorator.FrameDecorator):
    def __init__(self, fobj, name):
        super(JitDecorator, self).__init__(fobj)
        self.name = name

    def function(self):
        return self.name

class JitFilter:
    def __init__(self):
        self.name = 'JitFilter'
        self.enabled = True
        self.priority = 0

        gdb.current_progspace().frame_filters[self.name] = self

    def filter(self, frame_iter):
        for frame in frame_iter:
            frame_addr = frame.inferior_frame().pc()
            for (addr, size, name) in jit_functions():
                if frame_addr >= addr and frame_addr < addr + size:
                    yield JitDecorator(frame, name)
                    break
            else:
                yield frame

JitFilter()

[bjorn3]

This is the smallest that still reproduces the bug:

fn main() {
    println!("{:?}", std::env::args().collect::<Vec<_>>());

    let stderr = ::std::io::stderr();

    std::thread::spawn(move || {}).join().unwrap();
}

[bjorn3]

This does not reproduce on x86_64.

[bjorn3]

Relocation seems to be going wrong:

Thread 35 "rustc" received signal SIGSEGV, Segmentation fault.
0x0000e51f7b373940 in ?? ()
#0  0x0000e51f7b373940 in ??? ()
#1  0x0000e51f8267ab98 in _RINvXse_NtCs7CR2j41Mp4V_5alloc3vecINtB6_3VechEINtNtNtNtCs532DVppSGjo_4core4iter6traits7collect12FromIteratorhE9from_iterINtNtNtBP_8adapters4take4TakeINtNtNtBP_7so
(gdb) p/x $lr
$2 = 0xe51f8267ab98
(gdb) x/16i $lr-4
   0xe51f8267ab94:      bl      0xe51f7b373940

It seems like this is an out-of-bounds R_AARCH64_CALL26 relocation that didn't get caught due to an incorrect assertion in cranelift-jit. https://github.com/bytecodealliance/wasmtime/blob/0889323abf3d443880052e8bf84c92bab1beae30/cranelift/jit/src/compiled_blob.rs#L87 should have used 25 rather than 26 to avoid the sign bit of what will be the final value getting truncated away.

[bjorn3]

bytecodealliance/wasmtime#12239 will fix this.

[bjorn3]

There hasn't been a Cranelift release with the fix yet.