Assertion failure: global->as<GlobalObject>().getPrototype(Class::KEY).isUndefined(), at js/src/asmjs/WasmJS.cpp:644

RESOLVED FIXED in Firefox 50

Status

()

Core
JavaScript Engine
--
critical
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: decoder, Assigned: bbouvier)

Tracking

(Blocks: 3 bugs, {assertion, testcase})

Trunk
mozilla50
ARM
Linux
assertion, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox50 fixed)

Details

(Whiteboard: [jsbugmon:])

Attachments

(2 attachments)

(Reporter)

Description

2 years ago
The following testcase crashes on mozilla-central revision 1bee8d2da23e (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug --without-intl-api --enable-optimize --target=i686-pc-linux-gnu --enable-simulator=arm, run with --fuzzing-safe --thread-count=2 --arm-asm-nop-fill=1):

oomTest(function() {
    var lfGlobal = newGlobal()
    for (lfLocal in this)
        if (lfLocal) try {}
    catch (lfVare5) {
        fuzzutils.print(+lfVare5)
    }
})


Backtrace:

 received signal SIGSEGV, Segmentation fault.
0x084255b2 in InitConstructor<js::WasmMemoryObject> (name=<optimized out>, native=<optimized out>, wasm=..., global=..., cx=<optimized out>) at js/src/asmjs/WasmJS.cpp:644
#0  0x084255b2 in InitConstructor<js::WasmMemoryObject> (name=<optimized out>, native=<optimized out>, wasm=..., global=..., cx=<optimized out>) at js/src/asmjs/WasmJS.cpp:644
#1  js::InitWebAssemblyClass (cx=0xf7948000, global=...) at js/src/asmjs/WasmJS.cpp:687
#2  0x086adea1 in js::GlobalObject::resolveConstructor (cx=0xf7948000, global=..., key=JSProto_WebAssembly) at js/src/vm/GlobalObject.cpp:172
#3  0x086af2c7 in js::GlobalObject::ensureConstructor (key=JSProto_WebAssembly, global=..., cx=0xf7948000) at js/src/vm/GlobalObject.cpp:125
#4  js::GlobalObject::initStandardClasses (cx=0xf7948000, global=...) at js/src/vm/GlobalObject.cpp:425
#5  0x084ec7c2 in JS_EnumerateStandardClasses (cx=0xf7948000, obj=...) at js/src/jsapi.cpp:1096
#6  0x080813ed in global_enumerate (cx=0xf7948000, obj=...) at js/src/shell/js.cpp:6093
#7  0x0853f3c1 in Snapshot (cx=cx@entry=0xf7948000, pobj_=..., pobj_@entry=..., flags=flags@entry=1, props=0xffffb738) at js/src/jsiter.cpp:387
#8  0x08558fdc in js::GetIterator (cx=0xf7948000, obj=..., flags=1, objp=...) at js/src/jsiter.cpp:920
#9  0x08559700 in js::ValueToIterator (cx=0xf7948000, flags=1, vp=...) at js/src/jsiter.cpp:1205
#10 0x084a8067 in js::jit::Simulator::softwareInterrupt (this=0xf7927000, instr=0xf5442404) at js/src/jit/arm/Simulator-arm.cpp:2395
[...]
#16 0x081e72a7 in EnterBaseline (cx=cx@entry=0xf7948000, data=...) at js/src/jit/BaselineJIT.cpp:156
#17 0x081f58ef in js::jit::EnterBaselineMethod (cx=0xf7948000, state=...) at js/src/jit/BaselineJIT.cpp:194
#18 0x086bd230 in js::RunScript (cx=0xf7948000, state=...) at js/src/vm/Interpreter.cpp:389
#19 0x086bd57e in js::InternalCallOrConstruct (cx=0xf7948000, args=..., construct=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:471
#20 0x086bd7cd in InternalCall (cx=cx@entry=0xf7948000, args=...) at js/src/vm/Interpreter.cpp:498
#21 0x086bd95b in js::Call (cx=0xf7948000, fval=..., thisv=..., args=..., rval=...) at js/src/vm/Interpreter.cpp:517
#22 0x08504265 in JS_CallFunction (cx=0xf7948000, obj=..., fun=..., args=..., rval=...) at js/src/jsapi.cpp:2798
#23 0x08862993 in OOMTest (cx=0xf7948000, argc=1, vp=0xf5355058) at js/src/builtin/TestingFunctions.cpp:1360
[...]
#38 main (argc=5, argv=0xffffcc44, envp=0xffffcc5c) at js/src/shell/js.cpp:7518
eax	0x0	0
ebx	0x8baeff4	146468852
ecx	0xf7d9c864	-136722332
edx	0x0	0
esi	0xf7948000	-141262848
edi	0xffffb390	-19568
ebp	0xffffb408	4294947848
esp	0xffffb340	4294947648
eip	0x84255b2 <js::InitWebAssemblyClass(JSContext*, JS::Handle<JSObject*>)+2850>
=> 0x84255b2 <js::InitWebAssemblyClass(JSContext*, JS::Handle<JSObject*>)+2850>:	movl   $0x0,0x0
   0x84255bc <js::InitWebAssemblyClass(JSContext*, JS::Handle<JSObject*>)+2860>:	ud2

Updated

2 years ago
Whiteboard: [jsbugmon:update,bisect] → [jsbugmon:bisect]

Comment 1

2 years ago
JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Updated

2 years ago
Whiteboard: [jsbugmon:bisect] → [jsbugmon:]
(Assignee)

Comment 2

2 years ago
In InitConstructor, if we return false (e.g. because of an OOM) between the call to 

global->as<GlobalObject>().setPrototype(Class::KEY, ObjectValue(*proto));

and the end of the function, then the next time we'll call InitConstructor for the same class, we'll have a prototype already!

Should we just remove the assertion, or set the prototype only in the success path (at the end of the function, after the final DefineProperty call)?
Flags: needinfo?(luke)
(Assignee)

Updated

2 years ago
Blocks: 1243372

Comment 3

2 years ago
Thanks for looking into this!  Ah, so the root of the bug is that, even after we fail due to OOM, we don't tear down the whole global, so the init operations must be atomic (all-or-nothing).  Yes, that suggests doing any updates to the global at the end.
Flags: needinfo?(luke)
(Assignee)

Comment 4

2 years ago
Created attachment 8770080 [details] [diff] [review]
1.success-path.patch

This does what's said in previous comment. Not adding the test because it only triggers under an ARM simualtor build with --arm-asm-nop-fill=1 on my machine.
Assignee: nobody → bbouvier
Status: NEW → ASSIGNED
Attachment #8770080 - Flags: review?(luke)
(Assignee)

Comment 5

2 years ago
Created attachment 8770082 [details] [diff] [review]
2.strongly-assert-no-errors.patch

Drive-by change to unhide some potential decoding bugs.
Attachment #8770082 - Flags: review?(luke)

Updated

2 years ago
Attachment #8770080 - Flags: review?(luke) → review+

Comment 6

2 years ago
Comment on attachment 8770082 [details] [diff] [review]
2.strongly-assert-no-errors.patch

Review of attachment 8770082 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks!
Attachment #8770082 - Flags: review?(luke) → review+

Comment 7

2 years ago
Pushed by bbouvier@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1cabd2649c82
Set wasm objects prototype only in the success path; r=luke
https://hg.mozilla.org/integration/mozilla-inbound/rev/430b90bebb96
Strongly assert that there is no unhandled error in wasm decoding; r=luke

Comment 8

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/1cabd2649c82
https://hg.mozilla.org/mozilla-central/rev/430b90bebb96
Status: ASSIGNED → RESOLVED
Last Resolved: 2 years ago
status-firefox50: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla50
You need to log in before you can comment on or make changes to this bug.