1464279 - (msan) use of uninitialized value in wasm popFrame

Status: RESOLVED WONTFIX

(Core :: JavaScript: WebAssembly, defect, P5)

Description

[Steve Fink [:sfink] [:s:]]

(msan) use of uninitialized value in wasm popFrame

https://hg.mozilla.org/integration/mozilla-inbound/file/635e4b97033/js/src/wasm/WasmFrameIter.cpp#l116

==59090==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x2df149f in popFrame /builds/worker/workspace/build/src/js/src/wasm/WasmFrameIter.cpp:116:9
    #1 0x2df149f in js::wasm::WasmFrameIter::WasmFrameIter(js::jit::JitActivation*, js::wasm::Frame*) /builds/worker/workspace/build/src/js/src/wasm/WasmFrameIter.cpp:73
    #2 0x27a2b98 in construct<js::wasm::WasmFrameIter, js::jit::JitActivation *&> /builds/worker/workspace/build/src/obj-spider/dist/include/mozilla/MaybeOneOf.h:109:34
    #3 0x27a2b98 in js::JitFrameIter::JitFrameIter(js::jit::JitActivation*, bool) /builds/worker/workspace/build/src/js/src/vm/Stack.cpp:507
    #4 0x27a4f13 in js::FrameIter::settleOnActivation() /builds/worker/workspace/build/src/js/src/vm/Stack.cpp:691:32
    #5 0x27a81e1 in popActivation /builds/worker/workspace/build/src/js/src/vm/Stack.cpp:647:5
    #6 0x27a81e1 in popInterpreterFrame /builds/worker/workspace/build/src/js/src/vm/Stack.cpp:658
    #7 0x27a81e1 in js::FrameIter::operator++() /builds/worker/workspace/build/src/js/src/vm/Stack.cpp:853
    #8 0x268fb79 in js::SavedStacks::insertFrames(JSContext*, JS::MutableHandle<js::SavedFrame*>, mozilla::Variant<JS::AllFrames, JS::MaxFrames, JS::FirstSubsumedFrame>&&) /builds/worker/workspace/build/src/js/src/vm/SavedStacks.cpp:1508:9
    #9 0x268df97 in js::SavedStacks::saveCurrentStack(JSContext*, JS::MutableHandle<js::SavedFrame*>, mozilla::Variant<JS::AllFrames, JS::MaxFrames, JS::FirstSubsumedFrame>&&) /builds/worker/workspace/build/src/js/src/vm/SavedStacks.cpp:1295:12
    #10 0x1e71141 in CaptureCurrentStack /builds/worker/workspace/build/src/js/src/jsapi.cpp:7803:37
    #11 0x1e71141 in CaptureStack /builds/worker/workspace/build/src/js/src/jsexn.cpp:369
    #12 0x1e71141 in js::ErrorToException(JSContext*, JSErrorReport*, JSErrorFormatString const* (*)(void*, unsigned int), void*) /builds/worker/workspace/build/src/js/src/jsexn.cpp:686
    #13 0x23e415b in ReportError /builds/worker/workspace/build/src/js/src/vm/JSContext.cpp:249:5
    #14 0x23e415b in js::ReportErrorVA(JSContext*, unsigned int, char const*, js::ErrorArgumentsType, __va_list_tag*) /builds/worker/workspace/build/src/js/src/vm/JSContext.cpp:417
    #15 0x1e4d9d0 in JS_ReportErrorASCII(JSContext*, char const*, ...) /builds/worker/workspace/build/src/js/src/jsapi.cpp:6446:5
    #16 0x535c94 in AddMarkObservers(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/src/shell/js.cpp
    #17 0xa370f3 in CallJSNative /builds/worker/workspace/build/src/js/src/vm/JSContext-inl.h:280:15
    #18 0xa370f3 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:471
    #19 0xa12b1f in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:526:12
    #20 0xa12b1f in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3093
    #21 0x9fdea8 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:421:12
    #22 0xa375aa in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:493:15
    #23 0xa38ffb in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:539:10
    #24 0x2e25675 in js::wasm::Instance::callImport(JSContext*, unsigned int, unsigned int, unsigned long const*, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/wasm/WasmInstance.cpp:156:10
    #25 0x2e28079 in js::wasm::Instance::callImport_i32(js::wasm::Instance*, int, int, unsigned long*) /builds/worker/workspace/build/src/js/src/wasm/WasmInstance.cpp:252:20
    #26 0x7fffb4b1b0f0  (<unknown module>)

  Uninitialized value was created by an allocation of 'args' in the stack frame of function '_ZNK2js4wasm6Module11instantiateEP9JSContextN2JS6HandleINS4_8GCVectorIP10JSFunctionLm0ENS_15TempAllocPolicyEEEEENS5_IPNS_15WasmTableObjectEEENS5_IPNS_16WasmMemoryObjectEEERKN7mozilla6VectorINS0_3ValELm0ENS_17SystemAllocPolicyEEERNS6_IPNS_16WasmGlobalObjectELm0ESL_EENS5_IP8JSObjectEENS4_13MutableHandleIPNS_18WasmInstanceObjectEEE'
    #0 0x2ea27c0 in js::wasm::Module::instantiate(JSContext*, JS::Handle<JS::GCVector<JSFunction*, 0ul, js::TempAllocPolicy> >, JS::Handle<js::WasmTableObject*>, JS::Handle<js::WasmMemoryObject*>, mozilla::Vector<js::wasm::Val, 0ul, js::SystemAllocPolicy> const&, JS::GCVector<js::WasmGlobalObject*, 0ul, js::SystemAllocPolicy>&, JS::Handle<JSObject*>, JS::MutableHandle<js::WasmInstanceObject*>) const /builds/worker/workspace/build/src/js/src/wasm/WasmModule.cpp:1222

SUMMARY: MemorySanitizer: use-of-uninitialized-value /builds/worker/workspace/build/src/js/src/wasm/WasmFrameIter.cpp:116:9 in popFrame

Comment 1

[Julian Seward [:jseward]]

(In reply to Steve Fink [:sfink] [:s:] (PTO June 31) from comment #0)
Steve, what's the STR here?

Comment 2

[Steve Fink [:sfink] [:s:]]

(In reply to Julian Seward [:jseward] from comment #1)
> (In reply to Steve Fink [:sfink] [:s:] (PTO June 31) from comment #0)
> Steve, what's the STR here?

Right now, the STR is to run the SM(msan) job on try. :( (via try: -b do -p linux64 -u none).

My attempts to reproduce locally are running into other problems -- I get many, many more reports, seemingly because my msan isn't instrumenting some things (eg vsnprintf) that the one on try seems to? If you have any leads on that, I'm interested.

But I would ignore this particular bug for now. This might be an artifact of wasm running even when --disable-wasm is passed to the js shell; apparently that can happen if the test itself re-enables wasm. I think we need to get that straightened out first.

Comment 3

[Lars T Hansen [:lth]]

(In reply to Steve Fink [:sfink] [:s:] from comment #2)
> 
> This might be an artifact of
> wasm running even when --disable-wasm is passed to the js shell; apparently
> that can happen if the test itself re-enables wasm. I think we need to get
> that straightened out first.

I don't think that's the case.  Wasm execution is guarded (in wasm::HasSupport) on cx->options().wasm(), which is initialized from command line arguments and defaults to true; --no-wasm will set that flag to false on option initialization.  There is a toggleWasm() method on cx->options() but it is only used by the XPCShell.  The flag variable is private and can't be manipulated by other code.  And we will assert if !wasm::HasSupport() when we're trying to initialize the wasm engine.