1350143 - [wasm] Crash [@ js::wasm::CodeRange::funcIndex]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The following testcase crashes on mozilla-central revision 200182ef1156 (build with --enable-debug --enable-more-deterministic, run with --fuzzing-safe --no-threads --no-baseline --no-ion):

newGlobal().Debugger().addDebuggee(this);
t = new WebAssembly.Table({
    initial: 1,
    element: "anyfunc"
});
new WebAssembly.Instance(new WebAssembly.Module(wasmTextToBinary(`
    (module
        (func $iloop loop $top br $top end)
        (import "imports" "t" (table1 anyfunc))
        (elem (i32.const0) $iloop))
    `)), {
    imports: {
        t
    }
});
outer = new WebAssembly.Instance(new WebAssembly.Module(wasmTextToBinary(`
    (module
        (import "imports" "t" (table1 anyfunc))
        (type $v2v (func))
        (func (export "run")
            i32.const0
            call_indirect $v2v)
        )`)), {
    imports: {
        t
    }
});
timeout(0.01);
outer.exports.run();

Backtrace:

#0  js::wasm::CodeRange::funcIndex (this=0x0) at js/src/wasm/WasmCode.h:315
#1  js::wasm::FrameIterator::debugEnabled (this=this@entry=0x7ffc03bf0460) at js/src/wasm/WasmFrameIterator.cpp:231
#2  0x0000000000bd316f in js::FrameIter::hasUsableAbstractFramePtr (this=this@entry=0x7ffc03bf03d0) at js/src/vm/Stack.cpp:964
#3  0x0000000000b99858 in js::LiveSavedFrameCache::getFramePtr (iter=...) at js/src/vm/SavedStacks.cpp:60
#4  0x0000000000ba3985 in js::SavedStacks::insertFrames(JSContext*, js::FrameIter&, JS::MutableHandle<js::SavedFrame*>, mozilla::Variant<JS::AllFrames, JS::MaxFrames, JS::FirstSubsumedFrame>&&) (this=this@entry=0x7fc11f3498b8, cx=cx@entry=0x7fc11f371000, iter=..., frame=..., frame@entry=..., capture=capture@entry=<unknown type in /home/gkwubu/shell-cache/js-dbg-64-dm-linux-200182ef1156/js-dbg-64-dm-linux-200182ef1156, CU 0x4ca52c7, DIE 0x4e8fda9>) at js/src/vm/SavedStacks.cpp:1358
/snip

For detailed crash information, see attachment.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Detailed Crash Information

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/766ead465209
user:        Yury Delendik
date:        Sat Jan 07 10:36:11 2017 -0600
summary:     Bug 1286948 - Extends AbstractFramePtr to reference wasm::DebugFrame. r=luke,shu

Yury/Benjamin, is bug 1286948 a likely regressor?

Comment 3

[Benjamin Bouvier [:bbouvier] (inactive)]

Probably yes. I think there shouldn't be a DebugFrame when we're displaying the missing frames message, which is what's happening here.

Comment 4

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: Bug 1350143: Don't allow debug mode when there's no more frames in wasm non-profiling iteration;

Review commit: https://reviewboard.mozilla.org/r/123428/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/123428/

Comment 5

[Yury Delendik (:yury)]

Comment on attachment 8850913 [details]
Bug 1350143: Don't allow debug mode when there's no more frames in wasm non-profiling iteration;

https://reviewboard.mozilla.org/r/123428/#review125880

Looks good. I wonder if we shall add `MOZ_ASSERT_IF(missingFrameMessage, !codeRange);` above to be clear about invariant. Thanks.

Comment 6

[Luke Wagner [:luke]]

Hah, that test case looks familiar (https://hg.mozilla.org/mozilla-central/rev/60f7f03a4a6c#l4.3)

Comment 7

[Benjamin Bouvier [:bbouvier] (inactive)]

(In reply to Yury Delendik (:yury) from comment #5)
> Comment on attachment 8850913 [details]
> Bug 1350143: Don't allow debug mode when there's no more frames in wasm
> non-profiling iteration;
> 
> https://reviewboard.mozilla.org/r/123428/#review125880
> 
> Looks good. I wonder if we shall add `MOZ_ASSERT_IF(missingFrameMessage,
> !codeRange);` above to be clear about invariant. Thanks.

Sounds like a good idea to have this invariant. I think missingFrameMessage == !codeRange, even. Thanks.

(In reply to Luke Wagner [:luke] from comment #6)
> Hah, that test case looks familiar
> (https://hg.mozilla.org/mozilla-central/rev/60f7f03a4a6c#l4.3)

Yep, that's the work of randorderfuzz :) See also https://bugzilla.mozilla.org/show_bug.cgi?id=1100132#c0 .

Comment 8

[Benjamin Bouvier [:bbouvier] (inactive)]

Comment on attachment 8850913 [details]
Bug 1350143: Don't allow debug mode when there's no more frames in wasm non-profiling iteration;

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/123428/diff/1-2/

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/05f7a8eb6f45
Don't allow debug mode when there's no more frames in wasm non-profiling iteration; r=yury

Comment 10

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/05f7a8eb6f45

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Please request Aurora/Beta approval on this when you get a chance.

Comment 12

[Yury Delendik (:yury)]

We disabled bug mode on ff53-aurora (see bug 1332960), I don't think crash affects Beta.

Comment 13

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: aurora.patch

Approval Request Comment
[Feature/Bug causing the regression]: wasm debugger
[User impact if declined]: crashes when debugging wasm code
[Is this code covered by automated tests?]: yes
[Has the fix been verified in Nightly?]: yes
[Needs manual test from QE? If yes, steps to reproduce]: no
[List of other uplifts needed for the feature/fix]: none
[Is the change risky?]: very small risk
[Why is the change risky/not risky?]: conservative change, has a test
[String changes made/needed]: n/a

Carrying forward r+; that's the patch which landed after IRC discussions.

Comment 14

[Gerry Chang [:gchang]]

Comment on attachment 8851940 [details] [diff] [review]
aurora.patch

Fix a crashes when debugging wasm code. Aurora54+.

Comment 15

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/832e77512126