block-buffer crashes in digest_blocks on windows 32-bit

[bridiver]

We recently started seeing a crash only on win x86 and only in release build configurations. This happens on 0.10 and 0.9 in slightly different places. On 0.9 it's src\lib.rs:214 and 0.10 it's src\lib.rs:143
In both cases it triggers EXCEPTION_ILLEGAL_INSTRUCTION
If we change the debug_asserts to asserts it panics with

thread '<unnamed>' panicked at .\../../third_party/rust/block_buffer/v0_10/crate/src/lib.rs:198:13:
assertion failed: false

all other platforms/archs (mac, linux, android, win x64, etc..) run fine and win x86 also runs fine when not in release config

The value of self.pos is a high random number when self.size()==128 here https://github.com/brave/brave-core/blob/16cbd11281e8e37da88f6279f07016db74215852/third_party/rust/block_buffer/v0_9/crate/src/lib.rs#L214

with added assert on 0.9

thread '<unnamed>' panicked at .\../../third_party/rust/block_buffer/v0_9/crate/src/lib.rs:217:9:
self.size() = 128, self.pos = 4294967295

value of self.pos is different each for the same test

[bridiver]

In all cases we're calling this from sha2 0.99 (we modified it to work with block-buffer 0.10) https://github.com/RustCrypto/hashes/blob/sha2-v0.9.9/sha2/src/sha512.rs#L32

We are working on updating to sha2 0.10, but it's going to take some time to change things there because the api is different

[bridiver]

also relevant is that we're building with chromium which uses its own build system (no cargo) and a nightly rustc snapshot. This started failing after the bump to chromium 120.x which has some rust build changes and a different rustc nightly version, but the code calling this did not change

[newpavlov]

Looks like a memory corruption caused by some other unsafe code in your project, which got triggered by compiler update. It may be worth to trace your code with debugger to find the exact place where the pos field gets filled with garbage.

[bridiver]

@newpavlov we took the cpp code out of the equation and were still able to trigger the crash. It also provided a more useful error message https://github.com/brave/brave-core/blob/master/third_party/challenge_bypass_ristretto_ffi/src/lib.rs#L656

This was built as a pure rust exe, but using the chromium build system instead of cargo. I think the string in that link came from a test, but different strings were tried and all of them crashed

We're working on a rust repro that uses only safe rust and will report back

thread 'main' panicked at .\../../brave/third_party/rust/block_buffer/v0_9/crate/src/lib.rs:214:9:
attempt to subtract with overflow
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

[bridiver]

A safe version of the code built using chromium as a pure rust exe does not have the crash so looks like it is something in the unsafe rust ffi code. I'm going to close the issue.

[bridiver]

fyi - we have verified that the issue is an alignment change in llvm 18 https://reviews.llvm.org/D86310 and this patch fixes it rust-lang/rust#116672

We were (unknowingly at the time) using a previous version of the patch that was missing the config for win x86 and that's why it was the only platform the crash occurred on. Also see https://bugs.chromium.org/p/chromium/issues/detail?id=1510656