[WebAssembly] Assertion failure: aIndex < mLength, at js/src/debug64afl/dist/include/mozilla/Vector.h:458

RESOLVED FIXED in Firefox 47

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: decoder, Assigned: bbouvier)

Tracking

(Blocks: 1 bug, {assertion, regression, testcase})

Trunk
mozilla47
x86_64
Linux
assertion, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox47 fixed)

Details

Attachments

(2 attachments)

(Reporter)

Description

2 years ago
The attached binary WebAssembly testcase crashes on mozilla-central revision 211a4c710fb6 (build with --enable-gczeal --enable-optimize --enable-debug --enable-address-sanitizer --without-intl-api --enable-posix-nspr-emulation --disable-jemalloc --disable-tests, run with --fuzzing-safe --no-threads). To reproduce, you can run the following code in the JS shell:

var data = os.file.readFile(file, 'binary');
wasmEval(data.buffer);


Backtrace:

==13643==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000002443cdd bp 0x7ffff3bb97b0 sp 0x7ffff3bb97a0 T0)
    #0 0x2443cdc in mozilla::Vector<unsigned int, 0ul, js::SystemAllocPolicy>::operator[](unsigned long) const js/src/debug64afl/dist/include/mozilla/Vector.h:457:5
    #1 0x24ec572 in GenerateEntry(js::wasm::ModuleGenerator&, unsigned int, bool) js/src/asmjs/WasmStubs.cpp:239:17
    #2 0x24ec572 in js::wasm::GenerateStubs(js::wasm::ModuleGenerator&, bool) js/src/asmjs/WasmStubs.cpp:1080
    #3 0x243ced5 in js::wasm::ModuleGenerator::finish(js::wasm::HeapUsage, js::wasm::CacheableChars, mozilla::Vector<js::wasm::CacheableChars, 0ul, js::SystemAllocPolicy>&&, mozilla::UniquePtr<js::wasm::ModuleData, JS::DeletePolicy<js::wasm::ModuleData> >*, mozilla::UniquePtr<js::wasm::StaticLinkData, JS::DeletePolicy<js::wasm::StaticLinkData> >*, mozilla::Vector<js::wasm::SlowFunction, 0ul, js::TempAllocPolicy>*) js/src/asmjs/WasmGenerator.cpp:613:10
    #4 0x241ad43 in DecodeModule(JSContext*, mozilla::UniquePtr<char [], JS::FreePolicy>, unsigned char const*, unsigned int, JS::MutableHandle<js::WasmModuleObject*>, js::wasm::ExportMap*) js/src/asmjs/Wasm.cpp:540:10
    #5 0x241ad43 in WasmEval(JSContext*, unsigned int, JS::Value*) js/src/asmjs/Wasm.cpp:594
[...]
    #20 0x489c60 in _start (js/src/debug64afl/js/src/shell/js+0x489c60)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV js/src/debug64afl/dist/include/mozilla/Vector.h:457 mozilla::Vector<unsigned int, 0ul, js::SystemAllocPolicy>::operator[](unsigned long) const
==13643==ABORTING
(Reporter)

Comment 1

2 years ago
Created attachment 8712668 [details]
Testcase
(Assignee)

Comment 2

2 years ago
Created attachment 8712672 [details] [diff] [review]
declareddefined.patch

Thank you for the test case! This is based on bug 1243239.
Attachment #8712672 - Flags: review?(luke)
(Assignee)

Updated

2 years ago
Assignee: nobody → bbouvier
Status: NEW → ASSIGNED
Depends on: 1243239

Comment 3

2 years ago
Comment on attachment 8712672 [details] [diff] [review]
declareddefined.patch

Review of attachment 8712672 [details] [diff] [review]:
-----------------------------------------------------------------

D'oh, thanks!
Attachment #8712672 - Flags: review?(luke) → review+

Comment 5

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/a79d63b883ed
Status: ASSIGNED → RESOLVED
Last Resolved: 2 years ago
Last Resolved: 2 years ago
status-firefox47: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla47
You need to log in before you can comment on or make changes to this bug.