Bug 1871606 - Disable abstractFramePtr for IndirectCallBadSig trap. r…

…=rhunt

Differential Revision: https://phabricator.services.mozilla.com/D197785

js/src/jit-test/tests/wasm/tail-calls/bug1871606.js

@@ -0,0 +1,22 @@
+// |jit-test| --more-compartments; skip-variant-if: --wasm-test-serialization, true; skip-variant-if: --wasm-compiler=ion, true
+dbg = newGlobal();
+dbg.b = this;
+dbg.eval("(" + function() {
+  Debugger(b)
+} + ")()");
+var ins = wasmEvalText(`
+   (table 1 funcref)
+   (type $d (func (param f64)))
+   (func $e
+    (export "test")
+     f64.const 0.0
+     i32.const 0
+     return_call_indirect (type $d)
+   )
+   (elem (i32.const 0) $e)
+`);
+
+assertErrorMessage(
+  () => ins.exports.test(),
+  WebAssembly.RuntimeError, /indirect call signature mismatch/
+);

js/src/vm/JitActivation.cpp

@@ -251,6 +251,8 @@ void js::jit::JitActivation::startWasmTrap(wasm::Trap trap,
   wasmTrapData_->unwoundPC = pc;
   wasmTrapData_->trap = trap;
   wasmTrapData_->bytecodeOffset = bytecodeOffset;
+  wasmTrapData_->failedUnwindSignatureMismatch =
+      !unwound && trap == wasm::Trap::IndirectCallBadSig;
 
   MOZ_ASSERT(isWasmTrapping());
 }

js/src/wasm/WasmCodegenTypes.h

@@ -298,6 +298,11 @@ struct TrapData {
 
   Trap trap;
   uint32_t bytecodeOffset;
+
+  // A return_call_indirect from the first function in an activation into
+  // a signature mismatch may leave us with only one frame. This frame is
+  // validly constructed, but has no debug frame yet.
+  bool failedUnwindSignatureMismatch;
 };
 
 // The (,Callable,Func)Offsets classes are used to record the offsets of

js/src/wasm/WasmFrameIter.cpp

@@ -64,7 +64,8 @@ WasmFrameIter::WasmFrameIter(JitActivation* activation, wasm::Frame* fp)
       unwoundCallerFP_(nullptr),
       unwind_(Unwind::False),
       unwoundAddressOfReturnAddress_(nullptr),
-      resumePCinCurrentFrame_(nullptr) {
+      resumePCinCurrentFrame_(nullptr),
+      failedUnwindSignatureMismatch_(false) {
   MOZ_ASSERT(fp_);
   instance_ = GetNearestEffectiveInstance(fp_);
 
@@ -85,6 +86,7 @@ WasmFrameIter::WasmFrameIter(JitActivation* activation, wasm::Frame* fp)
     MOZ_ASSERT(codeRange_);
 
     lineOrBytecode_ = trapData.bytecodeOffset;
+    failedUnwindSignatureMismatch_ = trapData.failedUnwindSignatureMismatch;
 
     MOZ_ASSERT(!done());
     return;
@@ -241,6 +243,7 @@ void WasmFrameIter::popFrame() {
 
   MOZ_ASSERT(code_ == &instance()->code());
   lineOrBytecode_ = callsite->lineOrBytecode();
+  failedUnwindSignatureMismatch_ = false;
 
   MOZ_ASSERT(!done());
 }
@@ -320,6 +323,12 @@ bool WasmFrameIter::debugEnabled() const {
     return false;
   }
 
+  // Debug information is not available in prologue when the iterator is
+  // failing to unwind invalid signature trap.
+  if (failedUnwindSignatureMismatch_) {
+    return false;
+  }
+
   // Only non-imported functions can have debug frames.
   if (codeRange_->funcIndex() <
       code_->metadata(Tier::Debug).funcImports.length()) {

js/src/wasm/WasmFrameIter.h

@@ -71,6 +71,8 @@ class WasmFrameIter {
   Unwind unwind_;
   void** unwoundAddressOfReturnAddress_;
   uint8_t* resumePCinCurrentFrame_;
+  // See wasm::TrapData for more information.
+  bool failedUnwindSignatureMismatch_;
 
   void popFrame();