1507564 - Assertion failure: !masm.numCodeLabels(), at /js/src/wasm/WasmCode.cpp:767

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect)

Description

[Benjamin Bouvier [:bbouvier] (inactive)]

The following test case (reduced from a bigger one found by awsm) crashes the 32 bits x86 shells with Assertion failure: !masm.numCodeLabels(), at /js/src/wasm/WasmCode.cpp:767.

let i = new WebAssembly.Instance(new WebAssembly.Module(wasmTextToBinary(`
(module
    (func $f (result f32)
        f32.const nan:0x42
    )
    (table (export "table") 10 anyfunc)
    (elem (i32.const 0) $f)
)
`))).exports;

print(i.table.get(0)());

It's a null deref in opt builds, so keeping open. Patch incoming.

Comment 1

[Benjamin Bouvier [:bbouvier] (inactive)]

Attachment: Bug 1507564: Bind code labels when generating lazy table stubs; r?luke

A lazy stub could generate CodeLabels on x86, because of a constant NaN
generated for the entry's epilogue that ended up in a constant pool. We need to
actually bind these code labels in general.

Comment 2

[Benjamin Bouvier [:bbouvier] (inactive)]

We should track this and get it in as many versions of Firefox that we could. While not sec-critical, it causes crashes that end up being under wasm::Instance::callExport which is our general bucket of wasm crashes. I think it's there since bug 1422043 which implemented the lazy stubs.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5a42e724df88
Bind code labels when generating lazy table stubs; r=luke

Comment 4

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/5a42e724df88

Comment 5

[Ryan VanderMeulen [:RyanVM]]

This grafts cleanly to Beta/ESR60 as-landed. Please request approval when you get a chance.

Comment 6

[Benjamin Bouvier [:bbouvier] (inactive)]

Comment on attachment 9025429 [details]
Bug 1507564: Bind code labels when generating lazy table stubs; r?luke

[Beta/Release Uplift Approval Request]

Feature/Bug causing the regression: Bug 1422043

User impact if declined: Crashes in wasm code on x86 32 bits.

Is this code covered by automated tests?: Yes

Has the fix been verified in Nightly?: Yes

Needs manual test from QE?: No

If yes, steps to reproduce: 

List of other uplifts needed: None

Risk to taking this patch: Low

Why is the change risky/not risky? (and alternatives if risky): Very small patch.

String changes made/needed:

Comment 7

[Benjamin Bouvier [:bbouvier] (inactive)]

Comment on attachment 9025429 [details]
Bug 1507564: Bind code labels when generating lazy table stubs; r?luke

[ESR Uplift Approval Request]

If this is not a sec:{high,crit} bug, please state case for ESR consideration: See previous comment.

User impact if declined: 

Fix Landed on Version: 

Risk to taking this patch: Low

Why is the change risky/not risky? (and alternatives if risky): 

String or UUID changes made by this patch:

Comment 8

[Julien Cristau [:jcristau]]

Comment on attachment 9025429 [details]
Bug 1507564: Bind code labels when generating lazy table stubs; r?luke

wasm crash fix, approved for 64.0b11 and 60.4.0esr

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr60/rev/60619cc47b10

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/f6a1e485be9a