1455693 - Assertion failure: !cx->isExceptionPending(), at js/src/jsfriendapi.cpp:1070 with wasm and getBacktrace

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision f94b64e00202 (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --disable-profiling --enable-debug --enable-optimize, run with --fuzzing-safe --ion-offthread-compile=off --baseline-eager):

function wasmEvalText(str, imports) {
    let binary = wasmTextToBinary(str);
    m = new WebAssembly.Module(binary);
    return new WebAssembly.Instance(m, imports);
}
oomTest(function() {
    eval(`var code = \`(module
  (import \$i "env" "test")
  (func \$t (call \$i))
  (export "test" \$t)
)\`;
var mod = wasmEvalText(code, {
  env: {
    test: function() {
       var s = getBacktrace();
    }
  }
}).exports;
mod.test();
`);
});


Backtrace:

received signal SIGSEGV, Segmentation fault.
0x00000000009f91b0 in FormatFrame (showThisProps=<optimized out>, showLocals=<optimized out>, showArgs=<optimized out>, num=<optimized out>, inBuf=<optimized out>, iter=..., cx=<optimized out>) at js/src/jsfriendapi.cpp:1047
#0  0x00000000009f91b0 in FormatFrame (showThisProps=<optimized out>, showLocals=<optimized out>, showArgs=<optimized out>, num=<optimized out>, inBuf=<optimized out>, iter=..., cx=<optimized out>) at js/src/jsfriendapi.cpp:1047
#1  JS::FormatStackDump(JSContext*, mozilla::UniquePtr<char [], JS::FreePolicy>&&, bool, bool, bool) (cx=<optimized out>, inBuf=inBuf@entry=<unknown type in /home/ubuntu/build/dist/bin/js, CU 0x3dcb4ea, DIE 0x3f6296a>, showArgs=false, showLocals=false, showThisProps=false) at js/src/jsfriendapi.cpp:1083
#2  0x000000000085a412 in GetBacktrace (cx=<optimized out>, argc=<optimized out>, vp=<optimized out>) at js/src/builtin/TestingFunctions.cpp:3361
#3  0x000000000056eb9e in js::CallJSNative (cx=0x7ffff5f15000, native=0x85a3a0 <GetBacktrace(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/vm/JSContext-inl.h:280
#4  0x000000000056341f in js::InternalCallOrConstruct (cx=<optimized out>, cx@entry=0x7ffff5f15000, args=..., construct=construct@entry=js::NO_CONSTRUCT) at js/src/vm/Interpreter.cpp:467
#5  0x00000000005637fd in InternalCall (cx=0x7ffff5f15000, args=...) at js/src/vm/Interpreter.cpp:516
#6  0x000000000056394a in js::CallFromStack (cx=<optimized out>, args=...) at js/src/vm/Interpreter.cpp:522
#7  0x0000000000648c03 in js::jit::DoCallFallback (cx=<optimized out>, frame=0x7fffffff9698, stub_=<optimized out>, argc=<optimized out>, vp=0x7fffffff9650, res=...) at js/src/jit/BaselineIC.cpp:2380
#8  0x000034c01460b71c in ?? ()
#9  0x0000000000000000 in ?? ()
rax	0x0	0
rbx	0x7fffffff8910	140737488324880
rcx	0x7ffff6c212dd	140737333301981
rdx	0x0	0
rsi	0x7ffff6ef0770	140737336248176
rdi	0x7ffff6eef540	140737336243520
rbp	0x7fffffff8ed0	140737488326352
rsp	0x7fffffff86c0	140737488324288
r8	0x7ffff6ef0770	140737336248176
r9	0x7ffff7fe4780	140737354024832
r10	0x58	88
r11	0x7ffff6b977a0	140737332737952
r12	0x7fffffff88f0	140737488324848
r13	0x0	0
r14	0x7ffff5f15000	140737319620608
r15	0x7fffffff8a50	140737488325200
rip	0x9f91b0 <JS::FormatStackDump(JSContext*, mozilla::UniquePtr<char [], JS::FreePolicy>&&, bool, bool, bool)+2784>
=> 0x9f91b0 <JS::FormatStackDump(JSContext*, mozilla::UniquePtr<char [], JS::FreePolicy>&&, bool, bool, bool)+2784>:	movl   $0x0,0x0
   0x9f91bb <JS::FormatStackDump(JSContext*, mozilla::UniquePtr<char [], JS::FreePolicy>&&, bool, bool, bool)+2795>:	ud2

Comment 1

[Fuzzing Team]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/4119fba22f7f
user:        Dan Gohman
date:        Fri Sep 23 09:13:15 2016 -0500
summary:     Bug 1287220 - Baldr: update to binary version 0xc (r=luke)

This iteration took 217.981 seconds to run.

Comment 2

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: oom.patch

Comment 3

[Benjamin Bouvier [:bbouvier] (inactive)]

Pretty sure this affects all the existing versions of Firefox (source is bug 1294550). Not too much to worry about: only a simple OOM when dumping a stack for the debugger, I think.

Comment 4

[Yury Delendik (:yury)]

Comment on attachment 8970181 [details] [diff] [review]
oom.patch

Review of attachment 8970181 [details] [diff] [review]:
-----------------------------------------------------------------

lgtm

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/8076e3b57718
Check for memory allocation failures in FormatWasmFrame; r=yury

Comment 6

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/8076e3b57718