Reland "[turboassembler] Introduce hard-abort mode"
This is a reland of a462a7854a081f4f34bb4c112ee33f3d69efa309
Original change's description:
> [turboassembler] Introduce hard-abort mode
>
> For checks and assertions (mostly for debug code, like stack alignment
> or zero extension), we had two modes: Emit a call to the {Abort}
> runtime function (the default), and emit a debug break (used for
> testing, enabled via --trap-on-abort).
> In wasm, where we cannot just call a runtime function because code must
> be isolate independent, we always used the trap-on-abort behaviour.
> This causes problems for our fuzzers, which do not catch SIGTRAP, and
> hence do not detect debug code failures.
>
> This CL introduces a third mode ("hard abort"), which calls a C
> function via {ExternalReference}. The C function still outputs the
> abort reason, but does not print the stack trace. It then aborts via
> "OS::Abort", just like the runtime function.
> This will allow fuzzers to detect the crash and even find a nice error
> message.
>
> Even though this looks like a lot of code churn, it is actually not.
> Most added lines are new tests, and other changes are minimal.
>
> R=mstarzinger@chromium.org
>
> Bug: chromium:863799
> Change-Id: I77c58ff72db552d49014614436259ccfb49ba87b
> Reviewed-on: https://chromium-review.googlesource.com/1142163
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54592}
Bug: chromium:863799
Change-Id: I7729a47b4823a982a8e201df36520aa2b6ef5326
Reviewed-on: https://chromium-review.googlesource.com/1146100
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54656}
2018-07-24 14:12:47 +00:00
|
|
|
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
|
|
// found in the LICENSE file.
|
|
|
|
|
|
|
|
#ifndef V8_TEST_COMMON_ASSEMBLER_TESTER_H_
|
|
|
|
#define V8_TEST_COMMON_ASSEMBLER_TESTER_H_
|
|
|
|
|
2019-09-13 16:11:40 +00:00
|
|
|
#include <memory>
|
|
|
|
|
2019-05-21 09:30:15 +00:00
|
|
|
#include "src/codegen/assembler.h"
|
|
|
|
#include "src/codegen/code-desc.h"
|
Reland "[turboassembler] Introduce hard-abort mode"
This is a reland of a462a7854a081f4f34bb4c112ee33f3d69efa309
Original change's description:
> [turboassembler] Introduce hard-abort mode
>
> For checks and assertions (mostly for debug code, like stack alignment
> or zero extension), we had two modes: Emit a call to the {Abort}
> runtime function (the default), and emit a debug break (used for
> testing, enabled via --trap-on-abort).
> In wasm, where we cannot just call a runtime function because code must
> be isolate independent, we always used the trap-on-abort behaviour.
> This causes problems for our fuzzers, which do not catch SIGTRAP, and
> hence do not detect debug code failures.
>
> This CL introduces a third mode ("hard abort"), which calls a C
> function via {ExternalReference}. The C function still outputs the
> abort reason, but does not print the stack trace. It then aborts via
> "OS::Abort", just like the runtime function.
> This will allow fuzzers to detect the crash and even find a nice error
> message.
>
> Even though this looks like a lot of code churn, it is actually not.
> Most added lines are new tests, and other changes are minimal.
>
> R=mstarzinger@chromium.org
>
> Bug: chromium:863799
> Change-Id: I77c58ff72db552d49014614436259ccfb49ba87b
> Reviewed-on: https://chromium-review.googlesource.com/1142163
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54592}
Bug: chromium:863799
Change-Id: I7729a47b4823a982a8e201df36520aa2b6ef5326
Reviewed-on: https://chromium-review.googlesource.com/1146100
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54656}
2018-07-24 14:12:47 +00:00
|
|
|
|
|
|
|
namespace v8 {
|
|
|
|
namespace internal {
|
|
|
|
|
2019-01-17 10:23:16 +00:00
|
|
|
class TestingAssemblerBuffer : public AssemblerBuffer {
|
|
|
|
public:
|
2021-01-19 12:21:14 +00:00
|
|
|
TestingAssemblerBuffer(
|
|
|
|
size_t requested, void* address,
|
|
|
|
VirtualMemory::JitPermission jit_permission = VirtualMemory::kNoJit) {
|
2019-01-17 10:23:16 +00:00
|
|
|
size_t page_size = v8::internal::AllocatePageSize();
|
|
|
|
size_t alloc_size = RoundUp(requested, page_size);
|
|
|
|
CHECK_GE(kMaxInt, alloc_size);
|
2021-01-19 12:21:14 +00:00
|
|
|
reservation_ = VirtualMemory(GetPlatformPageAllocator(), alloc_size,
|
|
|
|
address, page_size, jit_permission);
|
|
|
|
CHECK(reservation_.IsReserved());
|
|
|
|
MakeWritable();
|
2019-01-17 10:23:16 +00:00
|
|
|
}
|
Reland "[turboassembler] Introduce hard-abort mode"
This is a reland of a462a7854a081f4f34bb4c112ee33f3d69efa309
Original change's description:
> [turboassembler] Introduce hard-abort mode
>
> For checks and assertions (mostly for debug code, like stack alignment
> or zero extension), we had two modes: Emit a call to the {Abort}
> runtime function (the default), and emit a debug break (used for
> testing, enabled via --trap-on-abort).
> In wasm, where we cannot just call a runtime function because code must
> be isolate independent, we always used the trap-on-abort behaviour.
> This causes problems for our fuzzers, which do not catch SIGTRAP, and
> hence do not detect debug code failures.
>
> This CL introduces a third mode ("hard abort"), which calls a C
> function via {ExternalReference}. The C function still outputs the
> abort reason, but does not print the stack trace. It then aborts via
> "OS::Abort", just like the runtime function.
> This will allow fuzzers to detect the crash and even find a nice error
> message.
>
> Even though this looks like a lot of code churn, it is actually not.
> Most added lines are new tests, and other changes are minimal.
>
> R=mstarzinger@chromium.org
>
> Bug: chromium:863799
> Change-Id: I77c58ff72db552d49014614436259ccfb49ba87b
> Reviewed-on: https://chromium-review.googlesource.com/1142163
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54592}
Bug: chromium:863799
Change-Id: I7729a47b4823a982a8e201df36520aa2b6ef5326
Reviewed-on: https://chromium-review.googlesource.com/1146100
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54656}
2018-07-24 14:12:47 +00:00
|
|
|
|
2021-01-19 12:21:14 +00:00
|
|
|
~TestingAssemblerBuffer() { reservation_.Free(); }
|
2018-11-27 13:58:18 +00:00
|
|
|
|
2021-01-19 12:21:14 +00:00
|
|
|
byte* start() const override {
|
|
|
|
return reinterpret_cast<byte*>(reservation_.address());
|
|
|
|
}
|
Reland "[turboassembler] Introduce hard-abort mode"
This is a reland of a462a7854a081f4f34bb4c112ee33f3d69efa309
Original change's description:
> [turboassembler] Introduce hard-abort mode
>
> For checks and assertions (mostly for debug code, like stack alignment
> or zero extension), we had two modes: Emit a call to the {Abort}
> runtime function (the default), and emit a debug break (used for
> testing, enabled via --trap-on-abort).
> In wasm, where we cannot just call a runtime function because code must
> be isolate independent, we always used the trap-on-abort behaviour.
> This causes problems for our fuzzers, which do not catch SIGTRAP, and
> hence do not detect debug code failures.
>
> This CL introduces a third mode ("hard abort"), which calls a C
> function via {ExternalReference}. The C function still outputs the
> abort reason, but does not print the stack trace. It then aborts via
> "OS::Abort", just like the runtime function.
> This will allow fuzzers to detect the crash and even find a nice error
> message.
>
> Even though this looks like a lot of code churn, it is actually not.
> Most added lines are new tests, and other changes are minimal.
>
> R=mstarzinger@chromium.org
>
> Bug: chromium:863799
> Change-Id: I77c58ff72db552d49014614436259ccfb49ba87b
> Reviewed-on: https://chromium-review.googlesource.com/1142163
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54592}
Bug: chromium:863799
Change-Id: I7729a47b4823a982a8e201df36520aa2b6ef5326
Reviewed-on: https://chromium-review.googlesource.com/1146100
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54656}
2018-07-24 14:12:47 +00:00
|
|
|
|
2021-01-19 12:21:14 +00:00
|
|
|
int size() const override { return static_cast<int>(reservation_.size()); }
|
2019-01-17 10:23:16 +00:00
|
|
|
|
|
|
|
std::unique_ptr<AssemblerBuffer> Grow(int new_size) override {
|
|
|
|
FATAL("Cannot grow TestingAssemblerBuffer");
|
|
|
|
}
|
|
|
|
|
|
|
|
std::unique_ptr<AssemblerBuffer> CreateView() const {
|
2021-01-19 12:21:14 +00:00
|
|
|
return ExternalAssemblerBuffer(start(), size());
|
2019-01-17 10:23:16 +00:00
|
|
|
}
|
2018-11-19 17:09:52 +00:00
|
|
|
|
2019-01-17 10:23:16 +00:00
|
|
|
void MakeExecutable() {
|
|
|
|
// Flush the instruction cache as part of making the buffer executable.
|
|
|
|
// Note: we do this before setting permissions to ReadExecute because on
|
|
|
|
// some older ARM kernels there is a bug which causes an access error on
|
|
|
|
// cache flush instructions to trigger access error on non-writable memory.
|
|
|
|
// See https://bugs.chromium.org/p/v8/issues/detail?id=8157
|
2021-01-19 12:21:14 +00:00
|
|
|
FlushInstructionCache(start(), size());
|
2019-01-17 10:23:16 +00:00
|
|
|
|
2021-01-19 12:21:14 +00:00
|
|
|
bool result = SetPermissions(GetPlatformPageAllocator(), start(), size(),
|
2019-01-17 10:23:16 +00:00
|
|
|
v8::PageAllocator::kReadExecute);
|
|
|
|
CHECK(result);
|
|
|
|
}
|
|
|
|
|
|
|
|
void MakeWritable() {
|
2021-01-19 12:21:14 +00:00
|
|
|
bool result = SetPermissions(GetPlatformPageAllocator(), start(), size(),
|
2019-01-17 10:23:16 +00:00
|
|
|
v8::PageAllocator::kReadWrite);
|
|
|
|
CHECK(result);
|
|
|
|
}
|
|
|
|
|
|
|
|
// TODO(wasm): Only needed for the "test-jump-table-assembler.cc" tests.
|
|
|
|
void MakeWritableAndExecutable() {
|
2021-01-19 12:21:14 +00:00
|
|
|
bool result = SetPermissions(GetPlatformPageAllocator(), start(), size(),
|
2019-01-17 10:23:16 +00:00
|
|
|
v8::PageAllocator::kReadWriteExecute);
|
|
|
|
CHECK(result);
|
|
|
|
}
|
|
|
|
|
|
|
|
private:
|
2021-01-19 12:21:14 +00:00
|
|
|
VirtualMemory reservation_;
|
2019-01-17 10:23:16 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
static inline std::unique_ptr<TestingAssemblerBuffer> AllocateAssemblerBuffer(
|
2019-11-13 16:58:58 +00:00
|
|
|
size_t requested = v8::internal::AssemblerBase::kDefaultBufferSize,
|
2021-01-19 12:21:14 +00:00
|
|
|
void* address = nullptr,
|
|
|
|
VirtualMemory::JitPermission jit_permission = VirtualMemory::kNoJit) {
|
|
|
|
return std::make_unique<TestingAssemblerBuffer>(requested, address,
|
|
|
|
jit_permission);
|
Reland "[turboassembler] Introduce hard-abort mode"
This is a reland of a462a7854a081f4f34bb4c112ee33f3d69efa309
Original change's description:
> [turboassembler] Introduce hard-abort mode
>
> For checks and assertions (mostly for debug code, like stack alignment
> or zero extension), we had two modes: Emit a call to the {Abort}
> runtime function (the default), and emit a debug break (used for
> testing, enabled via --trap-on-abort).
> In wasm, where we cannot just call a runtime function because code must
> be isolate independent, we always used the trap-on-abort behaviour.
> This causes problems for our fuzzers, which do not catch SIGTRAP, and
> hence do not detect debug code failures.
>
> This CL introduces a third mode ("hard abort"), which calls a C
> function via {ExternalReference}. The C function still outputs the
> abort reason, but does not print the stack trace. It then aborts via
> "OS::Abort", just like the runtime function.
> This will allow fuzzers to detect the crash and even find a nice error
> message.
>
> Even though this looks like a lot of code churn, it is actually not.
> Most added lines are new tests, and other changes are minimal.
>
> R=mstarzinger@chromium.org
>
> Bug: chromium:863799
> Change-Id: I77c58ff72db552d49014614436259ccfb49ba87b
> Reviewed-on: https://chromium-review.googlesource.com/1142163
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54592}
Bug: chromium:863799
Change-Id: I7729a47b4823a982a8e201df36520aa2b6ef5326
Reviewed-on: https://chromium-review.googlesource.com/1146100
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54656}
2018-07-24 14:12:47 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
} // namespace internal
|
|
|
|
} // namespace v8
|
|
|
|
|
|
|
|
#endif // V8_TEST_COMMON_ASSEMBLER_TESTER_H_
|