1243373 - [WebAssembly] Assertion failure: aIndex < mLength, at js/src/debug64afl/dist/include/mozilla/Vector.h:458

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The attached binary WebAssembly testcase crashes on mozilla-central revision 211a4c710fb6 (build with --enable-gczeal --enable-optimize --enable-debug --enable-address-sanitizer --without-intl-api --enable-posix-nspr-emulation --disable-jemalloc --disable-tests, run with --fuzzing-safe --no-threads). To reproduce, you can run the following code in the JS shell:

var data = os.file.readFile(file, 'binary');
wasmEval(data.buffer);


Backtrace:

==13643==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000002443cdd bp 0x7ffff3bb97b0 sp 0x7ffff3bb97a0 T0)
    #0 0x2443cdc in mozilla::Vector<unsigned int, 0ul, js::SystemAllocPolicy>::operator[](unsigned long) const js/src/debug64afl/dist/include/mozilla/Vector.h:457:5
    #1 0x24ec572 in GenerateEntry(js::wasm::ModuleGenerator&, unsigned int, bool) js/src/asmjs/WasmStubs.cpp:239:17
    #2 0x24ec572 in js::wasm::GenerateStubs(js::wasm::ModuleGenerator&, bool) js/src/asmjs/WasmStubs.cpp:1080
    #3 0x243ced5 in js::wasm::ModuleGenerator::finish(js::wasm::HeapUsage, js::wasm::CacheableChars, mozilla::Vector<js::wasm::CacheableChars, 0ul, js::SystemAllocPolicy>&&, mozilla::UniquePtr<js::wasm::ModuleData, JS::DeletePolicy<js::wasm::ModuleData> >*, mozilla::UniquePtr<js::wasm::StaticLinkData, JS::DeletePolicy<js::wasm::StaticLinkData> >*, mozilla::Vector<js::wasm::SlowFunction, 0ul, js::TempAllocPolicy>*) js/src/asmjs/WasmGenerator.cpp:613:10
    #4 0x241ad43 in DecodeModule(JSContext*, mozilla::UniquePtr<char [], JS::FreePolicy>, unsigned char const*, unsigned int, JS::MutableHandle<js::WasmModuleObject*>, js::wasm::ExportMap*) js/src/asmjs/Wasm.cpp:540:10
    #5 0x241ad43 in WasmEval(JSContext*, unsigned int, JS::Value*) js/src/asmjs/Wasm.cpp:594
[...]
    #20 0x489c60 in _start (js/src/debug64afl/js/src/shell/js+0x489c60)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV js/src/debug64afl/dist/include/mozilla/Vector.h:457 mozilla::Vector<unsigned int, 0ul, js::SystemAllocPolicy>::operator[](unsigned long) const
==13643==ABORTING

Comment 1

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 2

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: declareddefined.patch

Thank you for the test case! This is based on bug 1243239.

Comment 3

[Luke Wagner [:luke]]

Comment on attachment 8712672 [details] [diff] [review]
declareddefined.patch

Review of attachment 8712672 [details] [diff] [review]:
-----------------------------------------------------------------

D'oh, thanks!

Comment 4

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/a79d63b883ed

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/a79d63b883ed

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/a79d63b883ed