{"action":"created","issue":{"url":"https://api.github.com/repos/paul99/v8m-rb/issues/143","labels_url":"https://api.github.com/repos/paul99/v8m-rb/issues/143/labels{/name}","comments_url":"https://api.github.com/repos/paul99/v8m-rb/issues/143/comments","events_url":"https://api.github.com/repos/paul99/v8m-rb/issues/143/events","html_url":"https://github.com/paul99/v8m-rb/issues/143","id":87188900,"number":143,"title":"Fix unaligned double access in: Unify decoding of deoptimization translations.","user":{"login":"paul99","id":131475,"avatar_url":"https://avatars.githubusercontent.com/u/131475?v=3","gravatar_id":"","url":"https://api.github.com/users/paul99","html_url":"https://github.com/paul99","followers_url":"https://api.github.com/users/paul99/followers","following_url":"https://api.github.com/users/paul99/following{/other_user}","gists_url":"https://api.github.com/users/paul99/gists{/gist_id}","starred_url":"https://api.github.com/users/paul99/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paul99/subscriptions","organizations_url":"https://api.github.com/users/paul99/orgs","repos_url":"https://api.github.com/users/paul99/repos","events_url":"https://api.github.com/users/paul99/events{/privacy}","received_events_url":"https://api.github.com/users/paul99/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/paul99/v8m-rb/labels/pri1","name":"pri1","color":"e11d21"}],"state":"open","locked":false,"assignee":{"login":"kilvadyb","id":1742387,"avatar_url":"https://avatars.githubusercontent.com/u/1742387?v=3","gravatar_id":"","url":"https://api.github.com/users/kilvadyb","html_url":"https://github.com/kilvadyb","followers_url":"https://api.github.com/users/kilvadyb/followers","following_url":"https://api.github.com/users/kilvadyb/following{/other_user}","gists_url":"https://api.github.com/users/kilvadyb/gists{/gist_id}","starred_url":"https://api.github.com/users/kilvadyb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kilvadyb/subscriptions","organizations_url":"https://api.github.com/users/kilvadyb/orgs","repos_url":"https://api.github.com/users/kilvadyb/repos","events_url":"https://api.github.com/users/kilvadyb/events{/privacy}","received_events_url":"https://api.github.com/users/kilvadyb/received_events","type":"User","site_admin":false},"milestone":null,"comments":2,"created_at":"2015-06-11T02:51:06Z","updated_at":"2015-06-15T13:28:37Z","closed_at":null,"body":"Commit `9127d4ee Unify decoding of deoptimization translations.` introduces some new use of pointers to doubles that are unaligned, and crash.\r\n\r\nKudo's to Rick who spotted this on the buildbot, and got to the root cause. \r\n\r\nTEST: mjsunit/debug-backtrace.js  with --turbo --always-opt\r\n\r\n    out/mipsel.release/d8 --test --random-seed=591134838 --turbo --always-opt --nohard-abort --nodead-code-elimination --nofold-constants --expose-debug-as debug test/mjsunit/mjsunit.js test/mjsunit/debug-backtrace.js\r\n\r\nThe problem is in new function TranslatedState::CreateNextTranslatedValue()  (https://chromium.googlesource.com/v8/v8/+/9127d4eef4248c6a5266c6ed9e9a32a4ce2423eb/src/deoptimizer.cc, line 2935). \r\n\r\nI'd strongly suspect case Translation::DOUBLE_REGISTER: , and the line registers->GetDoubleRegister(input_reg);, but I've not actually traced it that far.\r\n\r\nIt is clearly accessing a double from unaligned address, and gets a trap. I used the codescape 4.9.2 toolchain, built for mips32, and ran on Octeon-III board. I suspect any board with kernel alignment fixups _disabled_ will show this problem.\r\n\r\nWe will need a C workaround for doubles accesses, like we have in objects-inl.h. \r\n\r\nBalázs, can you please take a look at this? \r\n\r\n(It's possible that there are more access problems after we fix this one.)"},"comment":{"url":"https://api.github.com/repos/paul99/v8m-rb/issues/comments/112070175","html_url":"https://github.com/paul99/v8m-rb/issues/143#issuecomment-112070175","issue_url":"https://api.github.com/repos/paul99/v8m-rb/issues/143","id":112070175,"user":{"login":"kilvadyb","id":1742387,"avatar_url":"https://avatars.githubusercontent.com/u/1742387?v=3","gravatar_id":"","url":"https://api.github.com/users/kilvadyb","html_url":"https://github.com/kilvadyb","followers_url":"https://api.github.com/users/kilvadyb/followers","following_url":"https://api.github.com/users/kilvadyb/following{/other_user}","gists_url":"https://api.github.com/users/kilvadyb/gists{/gist_id}","starred_url":"https://api.github.com/users/kilvadyb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kilvadyb/subscriptions","organizations_url":"https://api.github.com/users/kilvadyb/orgs","repos_url":"https://api.github.com/users/kilvadyb/repos","events_url":"https://api.github.com/users/kilvadyb/events{/privacy}","received_events_url":"https://api.github.com/users/kilvadyb/received_events","type":"User","site_admin":false},"created_at":"2015-06-15T13:28:37Z","updated_at":"2015-06-15T13:28:37Z","body":"The problem is in the function TranslatedState::CreateNextTranslatedValue() as Paul expected but in the Translation::DOUBLE_STACK_SLOT case of the switch. With the following patch I printed out the values:\r\n```\r\n@@ -3084,7 +3085,9 @@ TranslatedValue TranslatedState::CreateNextTranslatedValue(\r\n \r\n     case Translation::DOUBLE_STACK_SLOT: {\r\n       int slot_offset = SlotOffsetFp(iterator->Next());\r\n+      fprintf(stderr, \"address: %p, slot offset: %d\\n\", fp, slot_offset);\r\n       double value = *(reinterpret_cast<double*>(fp + slot_offset));\r\n\r\n```\r\nThe printed address and offset match to the values of v0, v1 registers of ldxc1 in the debugger when the SIGILL is caught:\r\n```\r\n   0x004b5358 <+308>:\tlw\tv1,248(sp)\r\n   0x004b535c <+312>:\tsll\tv0,v0,0x2\r\n=> 0x004b5360 <+316>:\tbeqz\ts2,0x4b5394 <_ZN2v88internal15Translated...>\r\n   0x004b5364 <+320>:\tldxc1\t$f20,v1(v0)\r\n```\r\nIn the C++ code fp holds the base address and is not 8 byte aligned. The easiest fix would be to use READ_DOUBLE_FIELD() macro from object-inl.h."}}