1463378 - Assertion failure: !isInvalid(), at js/src/wasm/WasmAST.h:86 with wasmTextToBinary

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision dc1868d255be (build with --enable-posix-nspr-emulation --enable-valgrind --enable-gczeal --disable-tests --disable-profiling --enable-debug --enable-optimize, run with --fuzzing-safe):

function _augmentSrc(src, assertions) {
    let i = 0;
    let newSrc = src.substr(0, src.lastIndexOf(')'));
    for (let {
            func,
        } of assertions) {
        newSrc += `
        (func (export "assert_${i++}") (result i32)
         call ${func}`;
    }
    return newSrc;
}
wasmTextToBinary(_augmentSrc(`(module)`, [{ func: 0xffffffff }]));


Backtrace:

received signal SIGSEGV, Segmentation fault.
0x0000000000e77e28 in js::wasm::AstRef::AstRef (index=<optimized out>, this=<optimized out>) at js/src/wasm/WasmAST.h:86
#0  0x0000000000e77e28 in js::wasm::AstRef::AstRef (index=<optimized out>, this=<optimized out>) at js/src/wasm/WasmAST.h:86
#1  (anonymous namespace)::WasmTokenStream::matchRef (this=this@entry=0x7fffffffc7a0, ref=ref@entry=0x7fffffffc160, error=0x7fffffffc8a0) at js/src/wasm/WasmTextToBinary.cpp:708
#2  0x0000000000e7f5a5 in ParseCall (inParens=false, c=...) at js/src/wasm/WasmTextToBinary.cpp:1958
#3  ParseExprBody (c=..., token=..., inParens=inParens@entry=false) at js/src/wasm/WasmTextToBinary.cpp:3048
#4  0x0000000000e815e5 in ParseExprList (c=..., exprs=exprs@entry=0x7fffffffc4a0) at js/src/wasm/WasmTextToBinary.cpp:1811
#5  0x0000000000e857f7 in ParseFunc (c=..., module=module@entry=0x7ffff480f020) at js/src/wasm/WasmTextToBinary.cpp:3320
#6  0x0000000000e8db40 in ParseModule (binary=<synthetic pointer>, error=<optimized out>, lifo=..., stackLimit=<optimized out>, text=<optimized out>) at js/src/wasm/WasmTextToBinary.cpp:3969
#7  js::wasm::TextToBinary (text=<optimized out>, stackLimit=<optimized out>, bytes=bytes@entry=0x7fffffffc910, error=error@entry=0x7fffffffc8a0) at js/src/wasm/WasmTextToBinary.cpp:5692
#8  0x00000000008c0222 in WasmTextToBinary (cx=<optimized out>, argc=<optimized out>, vp=<optimized out>) at js/src/builtin/TestingFunctions.cpp:679
#9  0x00000000005b59be in js::CallJSNative (cx=0x7ffff5f17000, native=0x8bffc0 <WasmTextToBinary(JSContext*, unsigned int, JS::Value*)>, args=...) at js/src/vm/JSContext-inl.h:280
[...]
#23 main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at js/src/shell/js.cpp:9326
rax	0x0	0
rbx	0x7fffffffc7a0	140737488340896
rcx	0x7ffff6c282ad	140737333330605
rdx	0x0	0
rsi	0x7ffff6ef7770	140737336276848
rdi	0x7ffff6ef6540	140737336272192
rbp	0x7fffffffc100	140737488339200
rsp	0x7fffffffc0b0	140737488339120
r8	0x7ffff6ef7770	140737336276848
r9	0x7ffff7fe4780	140737354024832
r10	0x58	88
r11	0x7ffff6b9e7a0	140737332766624
r12	0x7fffffffc160	140737488339296
r13	0x7fffffffc8a0	140737488341152
r14	0x7fffffffc7a0	140737488340896
r15	0x7fffffffc180	140737488339328
rip	0xe77e28 <(anonymous namespace)::WasmTokenStream::matchRef(js::wasm::AstRef*, JS::UniqueChars*)+232>
=> 0xe77e28 <(anonymous namespace)::WasmTokenStream::matchRef(js::wasm::AstRef*, JS::UniqueChars*)+232>:	movl   $0x0,0x0
   0xe77e33 <(anonymous namespace)::WasmTokenStream::matchRef(js::wasm::AstRef*, JS::UniqueChars*)+243>:	ud2


Likely a shell-only problem with wasmTextToBinary.

Comment 1

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: fix.patch

Indeed.

Comment 2

[Fuzzing Team]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/4119fba22f7f
user:        Dan Gohman
date:        Fri Sep 23 09:13:15 2016 -0500
summary:     Bug 1287220 - Baldr: update to binary version 0xc (r=luke)

This iteration took 1.093 seconds to run.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1b3d77d25711
Guard against sentinel values when creating AstRef; r=luke

Comment 4

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/1b3d77d25711