• Bruce Dawson's avatar
    Revert "Speculative fix to crashes from a CPU bug" · e84e9b92
    Bruce Dawson authored
    This reverts commit 10360127.
    
    Reason for revert: This fix only had moderate impact and the
    underlying CPU bug has now been addressed.
    
    Original change's description:
    > Speculative fix to crashes from a CPU bug
    > 
    > For the last few months Chrome has been seeing many "impossible" crashes
    > on Intel Gemini Lake, family 6 model 122 stepping 1 CPUs. These crashes
    > only happen with 64-bit Chrome and only happen in the prologue of two
    > functions. The crashes come and go across different Chrome versions.
    > Analysis of most of the crashes shows that the address of the crashing
    > instruction follows some patterns:
    > 
    > When crashing in GetFieldIndex() the last byte of the address is always
    > 1c, 5c, 9c, or dc.
    > 
    > When crashing in UpdateCaches (fewer unique samples) the last byte of
    > the address is always 5d or 9d.
    > 
    > The address of the function is 0xc or 0xd bytes earlier so the crashing
    > functions always start with an address that ends in 10, 50, 90, or d0.
    > 
    > Those addresses are for the crashes on a load of the __security_cookie.
    > The crashes also occasionally happen on the two instructions that follow
    > the __security_cookie load in which case the crashing instruction's
    > address has been seen to end with 23 or a3. This corresponds to a
    > function start address of 10 or 90.
    > 
    > Since the crash involves reading incorrect instruction bytes when
    > crossing a 16-byte boundary and since the crash appears to only happen
    > with particular 16-byte alignments it seems reasonable to force the
    > function's alignments to a multiple of 32 to see if this reliably
    > avoids the crashes. This change uses the gcc/clang __attribute__
    > directive to force 32-byte alignment. I have tested this change enough to
    > verify that it triggers the desired alignment (with up to 31 "int 3"
    > instructions added for padding) but since I have never reproduced this
    > crash I have no way of testing its efficacy.
    > 
    > Bug: chromium:968683, chromium:964273
    > Change-Id: Ia6e1c6d1e044b84d274817374b25523303e78b51
    > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1803775
    > Reviewed-by: Toon Verwaest <verwaest@chromium.org>
    > Commit-Queue: Bruce Dawson <brucedawson@chromium.org>
    > Cr-Commit-Position: refs/heads/master@{#63804}
    
    TBR=brucedawson@chromium.org,verwaest@chromium.org
    
    # Not skipping CQ checks because original CL landed > 1 day ago.
    
    Bug: chromium:968683, chromium:964273
    Change-Id: I150ecfebeff95e8f63dbba74d78491867dc17736
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2134728
    Commit-Queue: Toon Verwaest <verwaest@chromium.org>
    Auto-Submit: Bruce Dawson <brucedawson@chromium.org>
    Reviewed-by: 's avatarToon Verwaest <verwaest@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#66977}
    e84e9b92
Name
Last commit
Last update
..
OWNERS Loading commit data...
allocation-site-inl.h Loading commit data...
allocation-site-scopes-inl.h Loading commit data...
allocation-site-scopes.h Loading commit data...
allocation-site.h Loading commit data...
allocation-site.tq Loading commit data...
api-callbacks-inl.h Loading commit data...
api-callbacks.h Loading commit data...
api-callbacks.tq Loading commit data...
arguments-inl.h Loading commit data...
arguments.h Loading commit data...
arguments.tq Loading commit data...
backing-store.cc Loading commit data...
backing-store.h Loading commit data...
bigint.cc Loading commit data...
bigint.h Loading commit data...
cell-inl.h Loading commit data...
cell.h Loading commit data...
cell.tq Loading commit data...
code-inl.h Loading commit data...
code.cc Loading commit data...
code.h Loading commit data...
code.tq Loading commit data...
compilation-cache-inl.h Loading commit data...
compilation-cache.h Loading commit data...
compressed-slots-inl.h Loading commit data...
compressed-slots.h Loading commit data...
contexts-inl.h Loading commit data...
contexts.cc Loading commit data...
contexts.h Loading commit data...
contexts.tq Loading commit data...
data-handler-inl.h Loading commit data...
data-handler.h Loading commit data...
data-handler.tq Loading commit data...
debug-objects-inl.h Loading commit data...
debug-objects.cc Loading commit data...
debug-objects.h Loading commit data...
debug-objects.tq Loading commit data...
descriptor-array-inl.h Loading commit data...
descriptor-array.h Loading commit data...
descriptor-array.tq Loading commit data...
dictionary-inl.h Loading commit data...
dictionary.h Loading commit data...
elements-inl.h Loading commit data...
elements-kind.cc Loading commit data...
elements-kind.h Loading commit data...
elements.cc Loading commit data...
elements.h Loading commit data...
embedder-data-array-inl.h Loading commit data...
embedder-data-array.cc Loading commit data...
embedder-data-array.h Loading commit data...
embedder-data-array.tq Loading commit data...
embedder-data-slot-inl.h Loading commit data...
embedder-data-slot.h Loading commit data...
feedback-cell-inl.h Loading commit data...
feedback-cell.h Loading commit data...
feedback-cell.tq Loading commit data...
feedback-vector-inl.h Loading commit data...
feedback-vector.cc Loading commit data...
feedback-vector.h Loading commit data...
feedback-vector.tq Loading commit data...
field-index-inl.h Loading commit data...
field-index.h Loading commit data...
field-type.cc Loading commit data...
field-type.h Loading commit data...
fixed-array-inl.h Loading commit data...
fixed-array.h Loading commit data...
fixed-array.tq Loading commit data...
foreign-inl.h Loading commit data...
foreign.h Loading commit data...
foreign.tq Loading commit data...
frame-array-inl.h Loading commit data...
frame-array.h Loading commit data...
free-space-inl.h Loading commit data...
free-space.h Loading commit data...
free-space.tq Loading commit data...
function-kind.h Loading commit data...
function-syntax-kind.h Loading commit data...
hash-table-inl.h Loading commit data...
hash-table.h Loading commit data...
heap-number-inl.h Loading commit data...
heap-number.h Loading commit data...
heap-number.tq Loading commit data...
heap-object-inl.h Loading commit data...
heap-object.h Loading commit data...
heap-object.tq Loading commit data...
instance-type-inl.h Loading commit data...
instance-type.h Loading commit data...
internal-index.h Loading commit data...
intl-objects.cc Loading commit data...
intl-objects.h Loading commit data...
intl-objects.tq Loading commit data...
js-array-buffer-inl.h Loading commit data...
js-array-buffer.cc Loading commit data...
js-array-buffer.h Loading commit data...
js-array-buffer.tq Loading commit data...
js-array-inl.h Loading commit data...
js-array.h Loading commit data...
js-array.tq Loading commit data...
js-break-iterator-inl.h Loading commit data...
js-break-iterator.cc Loading commit data...
js-break-iterator.h Loading commit data...
js-collator-inl.h Loading commit data...
js-collator.cc Loading commit data...
js-collator.h Loading commit data...
js-collection-inl.h Loading commit data...
js-collection-iterator.h Loading commit data...
js-collection-iterator.tq Loading commit data...
js-collection.h Loading commit data...
js-collection.tq Loading commit data...
js-date-time-format-inl.h Loading commit data...
js-date-time-format.cc Loading commit data...
js-date-time-format.h Loading commit data...
js-display-names-inl.h Loading commit data...
js-display-names.cc Loading commit data...
js-display-names.h Loading commit data...
js-generator-inl.h Loading commit data...
js-generator.h Loading commit data...
js-generator.tq Loading commit data...
js-list-format-inl.h Loading commit data...
js-list-format.cc Loading commit data...
js-list-format.h Loading commit data...
js-locale-inl.h Loading commit data...
js-locale.cc Loading commit data...
js-locale.h Loading commit data...
js-number-format-inl.h Loading commit data...
js-number-format.cc Loading commit data...
js-number-format.h Loading commit data...
js-objects-inl.h Loading commit data...
js-objects.cc Loading commit data...
js-objects.h Loading commit data...
js-objects.tq Loading commit data...
js-plural-rules-inl.h Loading commit data...
js-plural-rules.cc Loading commit data...
js-plural-rules.h Loading commit data...
js-promise-inl.h Loading commit data...
js-promise.h Loading commit data...
js-promise.tq Loading commit data...
js-proxy-inl.h Loading commit data...
js-proxy.h Loading commit data...
js-proxy.tq Loading commit data...
js-regexp-inl.h Loading commit data...
js-regexp-string-iterator-inl.h Loading commit data...
js-regexp-string-iterator.h Loading commit data...
js-regexp-string-iterator.tq Loading commit data...
js-regexp.cc Loading commit data...
js-regexp.h Loading commit data...
js-regexp.tq Loading commit data...
js-relative-time-format-inl.h Loading commit data...
js-relative-time-format.cc Loading commit data...
js-relative-time-format.h Loading commit data...
js-segment-iterator-inl.h Loading commit data...
js-segment-iterator.cc Loading commit data...
js-segment-iterator.h Loading commit data...
js-segmenter-inl.h Loading commit data...
js-segmenter.cc Loading commit data...
js-segmenter.h Loading commit data...
js-weak-refs-inl.h Loading commit data...
js-weak-refs.h Loading commit data...
js-weak-refs.tq Loading commit data...
keys.cc Loading commit data...
keys.h Loading commit data...
layout-descriptor-inl.h Loading commit data...
layout-descriptor.cc Loading commit data...
layout-descriptor.h Loading commit data...
literal-objects-inl.h Loading commit data...
literal-objects.cc Loading commit data...
literal-objects.h Loading commit data...
literal-objects.tq Loading commit data...
lookup-cache-inl.h Loading commit data...
lookup-cache.cc Loading commit data...
lookup-cache.h Loading commit data...
lookup-inl.h Loading commit data...
lookup.cc Loading commit data...
lookup.h Loading commit data...
managed.cc Loading commit data...
managed.h Loading commit data...
map-inl.h Loading commit data...
map-updater.cc Loading commit data...
map-updater.h Loading commit data...
map.cc Loading commit data...
map.h Loading commit data...
map.tq Loading commit data...
maybe-object-inl.h Loading commit data...
maybe-object.h Loading commit data...
microtask-inl.h Loading commit data...
microtask.h Loading commit data...
microtask.tq Loading commit data...
module-inl.h Loading commit data...
module.cc Loading commit data...
module.h Loading commit data...
module.tq Loading commit data...
name-inl.h Loading commit data...
name.h Loading commit data...
name.tq Loading commit data...
object-list-macros.h Loading commit data...
object-macros-undef.h Loading commit data...
object-macros.h Loading commit data...
objects-body-descriptors-inl.h Loading commit data...
objects-body-descriptors.h Loading commit data...
objects-definitions.h Loading commit data...
objects-inl.h Loading commit data...
objects.cc Loading commit data...
objects.h Loading commit data...
oddball-inl.h Loading commit data...
oddball.h Loading commit data...
oddball.tq Loading commit data...
ordered-hash-table-inl.h Loading commit data...
ordered-hash-table.cc Loading commit data...
ordered-hash-table.h Loading commit data...
ordered-hash-table.tq Loading commit data...
osr-optimized-code-cache-inl.h Loading commit data...
osr-optimized-code-cache.cc Loading commit data...
osr-optimized-code-cache.h Loading commit data...
primitive-heap-object-inl.h Loading commit data...
primitive-heap-object.h Loading commit data...
primitive-heap-object.tq Loading commit data...
promise-inl.h Loading commit data...
promise.h Loading commit data...
promise.tq Loading commit data...
property-array-inl.h Loading commit data...
property-array.h Loading commit data...
property-array.tq Loading commit data...
property-cell-inl.h Loading commit data...
property-cell.h Loading commit data...
property-cell.tq Loading commit data...
property-descriptor-object-inl.h Loading commit data...
property-descriptor-object.h Loading commit data...
property-descriptor-object.tq Loading commit data...
property-descriptor.cc Loading commit data...
property-descriptor.h Loading commit data...
property-details.h Loading commit data...
property.cc Loading commit data...
property.h Loading commit data...
prototype-info-inl.h Loading commit data...
prototype-info.h Loading commit data...
prototype-info.tq Loading commit data...
prototype-inl.h Loading commit data...
prototype.h Loading commit data...
regexp-match-info.h Loading commit data...
regexp-match-info.tq Loading commit data...
scope-info.cc Loading commit data...
scope-info.h Loading commit data...
scope-info.tq Loading commit data...
script-inl.h Loading commit data...
script.h Loading commit data...
script.tq Loading commit data...
shared-function-info-inl.h Loading commit data...
shared-function-info.h Loading commit data...
shared-function-info.tq Loading commit data...
slots-atomic-inl.h Loading commit data...
slots-inl.h Loading commit data...
slots.h Loading commit data...
smi-inl.h Loading commit data...
smi.h Loading commit data...
source-text-module.cc Loading commit data...
source-text-module.h Loading commit data...
source-text-module.tq Loading commit data...
stack-frame-info-inl.h Loading commit data...
stack-frame-info.cc Loading commit data...
stack-frame-info.h Loading commit data...
stack-frame-info.tq Loading commit data...
string-comparator.cc Loading commit data...
string-comparator.h Loading commit data...
string-inl.h Loading commit data...
string-table-inl.h Loading commit data...
string-table.h Loading commit data...
string.cc Loading commit data...
string.h Loading commit data...
string.tq Loading commit data...
struct-inl.h Loading commit data...
struct.h Loading commit data...
struct.tq Loading commit data...
synthetic-module.cc Loading commit data...
synthetic-module.h Loading commit data...
synthetic-module.tq Loading commit data...
tagged-field-inl.h Loading commit data...
tagged-field.h Loading commit data...
tagged-impl-inl.h Loading commit data...
tagged-impl.cc Loading commit data...
tagged-impl.h Loading commit data...
tagged-index.h Loading commit data...
tagged-value-inl.h Loading commit data...
tagged-value.h Loading commit data...
template-objects-inl.h Loading commit data...
template-objects.cc Loading commit data...
template-objects.h Loading commit data...
template-objects.tq Loading commit data...
template.tq Loading commit data...
templates-inl.h Loading commit data...
templates.h Loading commit data...
transitions-inl.h Loading commit data...
transitions.cc Loading commit data...
transitions.h Loading commit data...
type-hints.cc Loading commit data...
type-hints.h Loading commit data...
value-serializer.cc Loading commit data...
value-serializer.h Loading commit data...
visitors.cc Loading commit data...
visitors.h Loading commit data...