1349871 - [wasm] Assertion failure: profilingReturn_ < end_, at js/src/wasm/WasmCode.cpp:350

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 7513b3f42058 (build with --enable-debug, run with --fuzzing-safe --no-threads --no-baseline --no-ion --wasm-always-baseline):

oomTest(Function(`
    new WebAssembly.Module(wasmTextToBinary(\`
        (module (func (result i32) (param f64) (param f32)
            i64.const 0
            get_local 0
            drop
            i32.wrap/i64
            f64.const 0
            f64.const 0
            i32.const 0
            select
            f32.const 0
            f32.const 0
            f32.const 0
            i32.const 0
            select
            i32.const 0
            i32.const 0
            i32.const 0
            select
            select
            drop
            drop
        ))
    \`))
`))

Backtrace:

/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Backtrace:

#0  0x0000000000cdc448 in js::wasm::CodeRange::CodeRange (this=<optimized out>, funcIndex=<optimized out>, funcLineOrBytecode=<optimized out>, offsets=...) at js/src/wasm/WasmCode.cpp:350
#1  0x0000000000d54195 in mozilla::detail::VectorImpl<js::wasm::CodeRange, 0ul, js::SystemAllocPolicy, true>::new_<unsigned int, unsigned int, js::wasm::FuncOffsets&>(js::wasm::CodeRange*, unsigned int&&, unsigned int&&, js::wasm::FuncOffsets&) (aDst=<optimized out>) at /home/skydbootxps/shell-cache/js-dbg-64-linux-7513b3f42058/objdir-js/dist/include/mozilla/Vector.h:171
#2  mozilla::Vector<js::wasm::CodeRange, 0ul, js::SystemAllocPolicy>::emplaceBack<unsigned int, unsigned int, js::wasm::FuncOffsets&>(unsigned int&&, unsigned int&&, js::wasm::FuncOffsets&) (this=<optimized out>) at /home/skydbootxps/shell-cache/js-dbg-64-linux-7513b3f42058/objdir-js/dist/include/mozilla/Vector.h:697
#3  js::wasm::ModuleGenerator::finishTask (this=this@entry=0x7ffe99786ab0, task=0x7f4aa9240000) at js/src/wasm/WasmGenerator.cpp:472
#4  0x0000000000d54c47 in js::wasm::ModuleGenerator::launchBatchCompile (this=this@entry=0x7ffe99786ab0) at js/src/wasm/WasmGenerator.cpp:960
#5  0x0000000000d54d0d in js::wasm::ModuleGenerator::finishFuncDefs (this=this@entry=0x7ffe99786ab0) at js/src/wasm/WasmGenerator.cpp:1005
/snip

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This is the first bug found from the experimental combination of the jsfunfuzz and awsm fuzzers. :)

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/958074f3b830
user:        Dan Gohman
date:        Fri Sep 23 09:13:15 2016 -0500
summary:     Bug 1287220 - Baldr: update to binary version 0xc (r=luke)

Not sure if this is directly related. Benjamin, is bug 1287220 a likely regressor?

Comment 5

[Fuzzing Team]

JSBugMon: Cannot process bug: Unable to automatically reproduce, please track manually.

Comment 6

[Benjamin Bouvier [:bbouvier] (inactive)]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #4)
> autoBisect shows this is probably related to the following changeset:
> 
> The first bad revision is:
> changeset:   https://hg.mozilla.org/mozilla-central/rev/958074f3b830
> user:        Dan Gohman
> date:        Fri Sep 23 09:13:15 2016 -0500
> summary:     Bug 1287220 - Baldr: update to binary version 0xc (r=luke)
> 
> Not sure if this is directly related. Benjamin, is bug 1287220 a likely
> regressor?

No, this commit introduces binary format changes, unrelated to this bug. I think the issue gets back to the start of the baseline compiler, which is trunk only at the moment.

Comment 7

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: Bug 1349871: Check for masm OOM at the end of baseline codegen;

Review commit: https://reviewboard.mozilla.org/r/123042/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/123042/

Comment 8

[Lars T Hansen [:lth]]

Comment on attachment 8850450 [details]
Bug 1349871: Check for masm OOM at the end of baseline codegen;

https://reviewboard.mozilla.org/r/123042/#review125342

I'm suprised that this is not caught higher up, but I've no objections to placing the check in the baseline compiler.  If it were me, I'd probably place it in emitFunction(), though, not in endFunction().

Comment 9

[Benjamin Bouvier [:bbouvier] (inactive)]

Comment on attachment 8850450 [details]
Bug 1349871: Check for masm OOM at the end of baseline codegen;

https://reviewboard.mozilla.org/r/123042/#review125342

Thanks for the review! If the location of the check is just personal preference, I'll keep it in endFunction() where all the other final references to masm are; masm doesn't appear at all in emitFunction().

Comment 10

[Jeff Walden [:Waldo]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #3)
> This is the first bug found from the experimental combination of the
> jsfunfuzz and awsm fuzzers. :)

https://www.youtube.com/watch?v=9nazm3_OXac

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/88cb0385ced6
Check for masm OOM at the end of baseline codegen; r=lth

Comment 12

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/88cb0385ced6

Comment 14

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Can we please backport this to aurora? It will be nice to fix it for fuzzing reasons.

Comment 15

[Benjamin Bouvier [:bbouvier] (inactive)]

Comment on attachment 8850450 [details]
Bug 1349871: Check for masm OOM at the end of baseline codegen;

Approval Request Comment
[Feature/Bug causing the regression]: wasm baseline compiler (bug 1232205)
[User impact if declined]: harder fuzzing
[Is this code covered by automated tests?]: yes
[Has the fix been verified in Nightly?]: yes
[Needs manual test from QE? If yes, steps to reproduce]: nope
[List of other uplifts needed for the feature/fix]: none
[Is the change risky?]: not much
[Why is the change risky/not risky?]: conservative 1 line fix
[String changes made/needed]: none

Comment 16

[Gerry Chang [:gchang]]

Comment on attachment 8850450 [details]
Bug 1349871: Check for masm OOM at the end of baseline codegen;

Fix an assertion failure related to wasm. Aurora54+.

Comment 17

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/96f912bd70b4