1331592 - Assertion failure: data_.state_ == INTERP, at js/src/vm/Stack.cpp:495 with Debugger and wasm

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 8eaf154b385b (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --enable-debug --enable-optimize, run with --fuzzing-safe --thread-count=2):

var lfLogBuffer = `
var evalInFrame = (function (global) {
  var dbgGlobal = newGlobal();
  var dbg = new dbgGlobal.Debugger();
  return function evalInFrame(upCount, code) {
    dbg.addDebuggee(global);
    var frame = dbg.getNewestFrame().older;
      frame = frame.older;
    var completion = frame.eval(code);
  };
})(this);
evalInFrame(8>>2, "x")
`;
var lfCodeBuffer = lfLogBuffer;
var lfModule = new WebAssembly.Module(wasmTextToBinary(`
    (module
        (import "global" "func" (result i32))
        (func (export "func_0") (result i32)
         call 0 ;; calls the import, which is func #0
        )
    )
`));
processModule(lfModule, lfCodeBuffer);
function processModule(module, jscode) {
        imports = {}
        for (let descriptor of WebAssembly.Module.imports(module)) {
                imports[descriptor.module] = {}
                    imports[descriptor.module][descriptor.name] = new Function("x", "y", "z", jscode);
        try {    
            instance = new WebAssembly.Instance(module, imports);
        } catch(exc) {
        }
    }
    for (let descriptor of WebAssembly.Module.exports(module)) {
        switch(descriptor.kind) {
            case "function":
                    print(instance.exports[descriptor.name]())
        }
    }
}



Backtrace:

 received signal SIGSEGV, Segmentation fault.
js::FrameIter::popInterpreterFrame (this=<optimized out>) at js/src/vm/Stack.cpp:495
#0  js::FrameIter::popInterpreterFrame (this=<optimized out>) at js/src/vm/Stack.cpp:495
#1  0x0000000000bce05e in js::FrameIter::operator++ (this=0x7fffffff9a10) at js/src/vm/Stack.cpp:706
#2  0x0000000000bce195 in js::FrameIter::operator++ (this=this@entry=0x7fffffff9a10) at js/src/vm/Stack.cpp:698
#3  0x0000000000ba06e8 in js::SavedStacks::insertFrames(JSContext*, js::FrameIter&, JS::MutableHandle<js::SavedFrame*>, mozilla::Variant<JS::AllFrames, JS::MaxFrames, JS::FirstSubsumedFrame>&&) (this=this@entry=0x7ffff692c0c0, cx=cx@entry=0x7ffff695f000, iter=..., frame=..., frame@entry=..., capture=capture@entry=<unknown type>) at js/src/vm/SavedStacks.cpp:1350
#4  0x0000000000ba0fe0 in js::SavedStacks::saveCurrentStack(JSContext*, JS::MutableHandle<js::SavedFrame*>, mozilla::Variant<JS::AllFrames, JS::MaxFrames, JS::FirstSubsumedFrame>&&) (this=this@entry=0x7ffff692c0c0, cx=cx@entry=0x7ffff695f000, frame=frame@entry=..., capture=capture@entry=<unknown type>) at js/src/vm/SavedStacks.cpp:1152
#5  0x000000000089e118 in JS::CaptureCurrentStack(JSContext*, JS::MutableHandle<JSObject*>, mozilla::Variant<JS::AllFrames, JS::MaxFrames, JS::FirstSubsumedFrame>&&) (cx=0x7ffff695f000, stackp=..., capture=capture@entry=<unknown type>) at js/src/jsapi.cpp:6815
#6  0x000000000090ab3b in CaptureStack (cx=<optimized out>, stack=..., stack@entry=...) at js/src/jsexn.cpp:305
#7  0x0000000000918fb5 in js::ErrorToException (cx=0x7ffff695f000, reportp=0x7fffffffa0e0, callback=<optimized out>, userRef=<optimized out>) at js/src/jsexn.cpp:618
#8  0x000000000091b51c in js::ReportErrorNumberVA (cx=cx@entry=0x7ffff695f000, flags=flags@entry=0, callback=callback@entry=0x90a720 <js::GetErrorMessage(void*, unsigned int)>, userRef=userRef@entry=0x0, errorNumber=errorNumber@entry=1, argumentsType=argumentsType@entry=js::ArgumentsAreLatin1, ap=0x7fffffffa1c0) at js/src/jscntxt.cpp:700
#9  0x000000000089966b in JS_ReportErrorNumberLatin1VA (cx=0x7ffff695f000, errorCallback=0x90a720 <js::GetErrorMessage(void*, unsigned int)>, userRef=0x0, errorNumber=1, ap=ap@entry=0x7fffffffa1c0) at js/src/jsapi.cpp:5683
#10 0x0000000000899718 in JS_ReportErrorNumberLatin1 (cx=cx@entry=0x7ffff695f000, errorCallback=errorCallback@entry=0x90a720 <js::GetErrorMessage(void*, unsigned int)>, userRef=userRef@entry=0x0, errorNumber=errorNumber@entry=1) at js/src/jsapi.cpp:5672
#11 0x0000000000910235 in js::ReportIsNotDefined (cx=cx@entry=0x7ffff695f000, id=id@entry=...) at js/src/jscntxt.cpp:761
#12 0x0000000000915ad5 in js::ReportIsNotDefined (cx=0x7ffff695f000, name=..., name@entry=...) at js/src/jscntxt.cpp:770
#13 0x000000000054d1e8 in js::FetchName<false> (cx=0x7ffff695f000, obj=..., obj2=..., name=..., shape=..., vp=...) at js/src/vm/Interpreter-inl.h:185
#14 0x0000000000535675 in GetNameOperation (vp=..., pc=<optimized out>, fp=<optimized out>, cx=0x7ffff695f000) at js/src/vm/Interpreter.cpp:233
#15 Interpret (cx=0x7ffff695f000, state=...) at js/src/vm/Interpreter.cpp:3094
#16 0x0000000000542285 in js::RunScript (cx=0x7ffff695f000, state=...) at js/src/vm/Interpreter.cpp:403
#17 0x0000000000544a90 in js::ExecuteKernel (cx=0x7ffff695f000, script=..., script@entry=..., envChainArg=..., newTargetValue=..., evalInFrame=..., result=result@entry=0x7fffffffaca0) at js/src/vm/Interpreter.cpp:684
#18 0x0000000000a88f11 in EvaluateInEnv (rval=..., lineno=<optimized out>, filename=0x1199f98 "debugger eval code", pc=<optimized out>, frame=..., env=..., cx=0x7ffff695f000, chars=...) at js/src/vm/Debugger.cpp:7720
#19 DebuggerGenericEval (cx=cx@entry=0x7ffff695f000, bindings=..., bindings@entry=..., options=..., status=@0x7fffffffb534: 32767, value=..., dbg=0x7ffff693e800, envArg=..., iter=0x7fffffffb038, chars=...) at js/src/vm/Debugger.cpp:7806
#20 0x0000000000a89b85 in js::DebuggerFrame::eval (cx=0x7ffff695f000, frame=..., frame@entry=..., chars=..., bindings=..., bindings@entry=..., options=..., status=@0x7fffffffb534: 32767, value=value@entry=...) at js/src/vm/Debugger.cpp:7830
#21 0x0000000000a89e11 in js::DebuggerFrame::evalMethod (cx=cx@entry=0x7ffff695f000, argc=<optimized out>, vp=<optimized out>) at js/src/vm/Debugger.cpp:8477
#22 0x000000000054c641 in js::CallJSNative (cx=cx@entry=0x7ffff695f000, native=0xa89bd0 <js::DebuggerFrame::evalMethod(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:239
#23 0x0000000000542561 in js::InternalCallOrConstruct (cx=0x7ffff695f000, args=..., construct=construct@entry=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:457
#24 0x0000000000542976 in InternalCall (cx=<optimized out>, args=...) at js/src/vm/Interpreter.cpp:502
#25 0x0000000000542aee in js::Call (cx=<optimized out>, fval=..., fval@entry=..., thisv=..., args=..., rval=...) at js/src/vm/Interpreter.cpp:521
#26 0x0000000000a21198 in js::Wrapper::call (this=this@entry=0x205bfc0 <js::CrossCompartmentWrapper::singleton>, cx=0x7ffff695f000, proxy=..., proxy@entry=..., args=...) at js/src/proxy/Wrapper.cpp:165
#27 0x0000000000a0e9c5 in js::CrossCompartmentWrapper::call (this=0x205bfc0 <js::CrossCompartmentWrapper::singleton>, cx=0x7ffff695f000, wrapper=..., args=...) at js/src/proxy/CrossCompartmentWrapper.cpp:333
#28 0x0000000000a17773 in js::Proxy::call (cx=0x7ffff695f000, proxy=proxy@entry=..., args=...) at js/src/proxy/Proxy.cpp:421
#29 0x0000000000a1b2b5 in js::proxy_Call (cx=cx@entry=0x7ffff695f000, argc=<optimized out>, vp=<optimized out>) at js/src/proxy/Proxy.cpp:662
#30 0x000000000054c641 in js::CallJSNative (cx=cx@entry=0x7ffff695f000, native=0xa1b240 <js::proxy_Call(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:239
#31 0x0000000000542857 in js::InternalCallOrConstruct (cx=0x7ffff695f000, args=..., construct=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:445
#32 0x00000000005344fe in js::CallFromStack (args=..., cx=<optimized out>) at js/src/vm/Interpreter.cpp:508
#33 Interpret (cx=0x7ffff695f000, state=...) at js/src/vm/Interpreter.cpp:2952
#34 0x0000000000542285 in js::RunScript (cx=cx@entry=0x7ffff695f000, state=...) at js/src/vm/Interpreter.cpp:403
#35 0x000000000054289a in js::InternalCallOrConstruct (cx=0x7ffff695f000, args=..., construct=construct@entry=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:475
#36 0x0000000000542976 in InternalCall (cx=<optimized out>, args=...) at js/src/vm/Interpreter.cpp:502
#37 0x0000000000542aee in js::Call (cx=<optimized out>, fval=..., fval@entry=..., thisv=..., thisv@entry=..., args=..., rval=..., rval@entry=...) at js/src/vm/Interpreter.cpp:521
#38 0x0000000000d52a77 in js::wasm::Instance::callImport (this=0x7ffff33da700, cx=cx@entry=0x7ffff695f000, funcImportIndex=funcImportIndex@entry=0, argc=argc@entry=0, argv=argv@entry=0x7fffffffc5e0, rval=..., rval@entry=...) at js/src/wasm/WasmInstance.cpp:177
#39 0x0000000000d5339e in js::wasm::Instance::callImport_i32 (instance=<optimized out>, funcImportIndex=0, argc=0, argv=0x7fffffffc5e0) at js/src/wasm/WasmInstance.cpp:268
#40 0x00007ffff7ff421f in ?? ()
#41 0x00007fffffffc650 in ?? ()
#42 0x0000000000beada1 in JS::Rooted<js::SavedFrame*>::rootLists (this=0x7fffffffc718, cx=0x7fffffffc6d0) at dist/include/js/RootingAPI.h:774
#43 JS::Rooted<js::SavedFrame*>::Rooted<JSContext*, JS::PersistentRooted<js::SavedFrame*>&> (initial=..., cx=<synthetic pointer>, this=0x7fffffffc718) at dist/include/js/RootingAPI.h:791
#44 js::Activation::Activation (this=0x7fffffffc6d0, cx=0x7fffffffc6d0, kind=(unknown: 4080904016)) at js/src/vm/Stack-inl.h:923
#45 0x0000000000d3d8bd in WasmCall (cx=0x7fffffffcb20, cx@entry=0x7ffff695f000, argc=<optimized out>, vp=<optimized out>) at js/src/wasm/WasmJS.cpp:1060
#46 0x000000000054c641 in js::CallJSNative (cx=cx@entry=0x7ffff695f000, native=0xd3d810 <WasmCall(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/jscntxtinlines.h:239
[...]
#59 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at js/src/shell/js.cpp:7963
rax	0x2064520	33965344
rbx	0x7fffffff9a10	140737488329232
rcx	0x123d690	19125904
rdx	0x0	0
rsi	0x7ffff6ef7770	140737336276848
rdi	0x7ffff6ef6540	140737336272192
rbp	0x7fffffff93a0	140737488327584
rsp	0x7fffffff9390	140737488327568
r8	0x7ffff6ef7770	140737336276848
r9	0x7ffff7fe4740	140737354024768
r10	0x58	88
r11	0x7ffff6b9f750	140737332770640
r12	0x7ffff322b0c1	140737272524993
r13	0x0	0
r14	0x7fffffff9a10	140737488329232
r15	0x7ffff695f000	140737330409472
rip	0xbc5481 <js::FrameIter::popInterpreterFrame()+97>
=> 0xbc5481 <js::FrameIter::popInterpreterFrame()+97>:	movl   $0x0,0x0
   0xbc548c <js::FrameIter::popInterpreterFrame()+108>:	ud2

Comment 1

[Yury Delendik (:yury)]

Smaller test case:

var module = new WebAssembly.Module(wasmTextToBinary(`
    (module
        (import "global" "func" (result i32))
        (func (export "func_0") (result i32)
         call 0 ;; calls the import, which is func #0
        )
    )
`));

var dbg;
(function (global) {
    var dbgGlobal = newGlobal();
    dbg = new dbgGlobal.Debugger();
    dbg.addDebuggee(global);
})(this);

var instance = new WebAssembly.Instance(module, { global: { func: () => {
    var frame = dbg.getNewestFrame().older;
    frame.eval("some_error");
}}});
instance.exports.func_0();

Comment 2

[Yury Delendik (:yury)]

Attachment: Bug 1331592 - Skipping wasm frames during debugger eval.

Review commit: https://reviewboard.mozilla.org/r/105570/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/105570/

Comment 3

[Luke Wagner [:luke]]

Comment on attachment 8828058 [details]
Bug 1331592 - Skipping wasm frames during debugger eval.

https://reviewboard.mozilla.org/r/105570/#review106388

Oops, nice job adding a test.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/29e806c862fa
Skipping wasm frames during debugger eval. r=luke

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/29e806c862fa