1586497 - Assertion failure: kind() == VectorKind, at js/src/wasm/WasmOpIter.h:134

Status: RESOLVED DUPLICATE of bug 1586502

(Core :: JavaScript: WebAssembly, defect)

Description

[Christian Holler (:decoder)]

The attached testcase crashes on mozilla-central revision 74c62117e3e5 (build with --enable-valgrind --enable-gczeal --enable-tests --enable-fuzzing --enable-debug --enable-address-sanitizer --disable-jemalloc --enable-optimize=-O2, run with --no-threads test.js).

Backtrace:

==27619==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x55ea685239de bp 0x7ffef1f43d70 sp 0x7ffef1f43d20 T0)
==27619==The signal is caused by a WRITE memory access.
==27619==Hint: address points to the zero page.
    #0 0x55ea685239dd in js::wasm::ResultType::operator==(js::wasm::ResultType) const js/src/wasm/WasmOpIter.h
    #1 0x55ea6865e5a0 in js::wasm::ResultType::operator!=(js::wasm::ResultType) const js/src/wasm/WasmOpIter.h:210:58
    #2 0x55ea6865e5a0 in js::wasm::OpIter<(anonymous namespace)::IonCompilePolicy>::checkBrTableEntry(unsigned int*, js::wasm::ResultType, js::wasm::ResultType*, mozilla::Vector<js::jit::MDefinition*, 8ul, js::SystemAllocPolicy>*) js/src/wasm/WasmOpIter.h:1420
    #3 0x55ea685f1e41 in js::wasm::OpIter<(anonymous namespace)::IonCompilePolicy>::readBrTable(mozilla::Vector<unsigned int, 8ul, js::SystemAllocPolicy>*, unsigned int*, js::wasm::ResultType*, mozilla::Vector<js::jit::MDefinition*, 8ul, js::SystemAllocPolicy>*, js::jit::MDefinition**) js/src/wasm/WasmOpIter.h:1460:10
    #4 0x55ea685f1e41 in EmitBrTable((anonymous namespace)::FunctionCompiler&) js/src/wasm/WasmIonCompile.cpp:1888
    #5 0x55ea685f1e41 in EmitBodyExprs((anonymous namespace)::FunctionCompiler&) js/src/wasm/WasmIonCompile.cpp:3396
    #6 0x55ea685dba36 in js::wasm::IonCompileFunctions(js::wasm::ModuleEnvironment const&, js::LifoAlloc&, mozilla::Vector<js::wasm::FuncCompileInput, 8ul, js::SystemAllocPolicy> const&, js::wasm::CompiledCode*, mozilla::UniquePtr<char [], JS::FreePolicy>*) js/src/wasm/WasmIonCompile.cpp:4204:12
    #7 0x55ea6859b345 in ExecuteCompileTask(js::wasm::CompileTask*, mozilla::UniquePtr<char [], JS::FreePolicy>*) js/src/wasm/WasmGenerator.cpp:736:12
    #8 0x55ea6859ee04 in js::wasm::ModuleGenerator::locallyCompileCurrentTask() js/src/wasm/WasmGenerator.cpp:775:8
    #9 0x55ea6859ee04 in js::wasm::ModuleGenerator::finishFuncDefs() js/src/wasm/WasmGenerator.cpp:904
    #10 0x55ea683f68d2 in bool DecodeCodeSection<js::wasm::Decoder>(js::wasm::ModuleEnvironment const&, js::wasm::Decoder&, js::wasm::ModuleGenerator&) js/src/wasm/WasmCompile.cpp:566:13
    #11 0x55ea683f588b in js::wasm::CompileBuffer(js::wasm::CompileArgs const&, js::wasm::ShareableBytes const&, mozilla::UniquePtr<char [], JS::FreePolicy>*, mozilla::Vector<mozilla::UniquePtr<char [], JS::FreePolicy>, 0ul, js::SystemAllocPolicy>*, JS::OptimizedEncodingListener*) js/src/wasm/WasmCompile.cpp:589:8
    #12 0x55ea686da75a in js::WasmModuleObject::construct(JSContext*, unsigned int, JS::Value*) js/src/wasm/WasmJS.cpp:1170:7
    #13 0x55ea656c470e in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) js/src/vm/Interpreter.cpp:458:13
[...]

Marking s-s as a start, because the assertion could indicate some kind of type-confusion.

Comment 1

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Andy Wingo [:wingo]]

Confirmed fixed by https://phabricator.services.mozilla.com/D43977?vs=172731&id=176741#toc. FWIW here is the wat:

(module
  (type (;0;) (func (param i32 i32 i32) (result i32)))
  (func $main (type 0) (param i32 i32 i32) (result i32)
    (unreachable)
    (unreachable)
    (unreachable)
    (if (result f32)  ;; label = @1
      (unreachable)
      (then
        (unreachable)
        (br_table 0 (;@1;))
        (unreachable)
        (loop (param i32 i32 i32) (result i32)  ;; label = @2
          (unreachable)
          (if (param i32 i32 i32) (result i32)  ;; label = @3
            (br_table 0 (;@3;) 0 (;@3;) 0 (;@3;) 0 (;@3;)
              (unreachable)
              (unreachable)
              (unreachable)
              (unreachable))
            (then))))))
  (export "main" (func $main)))

Comment 4

[Andy Wingo [:wingo]]

But, the bug found here is real; a late revision to the patch added a new ResultsType kind and this code didn't adapt accordingly. Fixed in https://phabricator.services.mozilla.com/D43977?vs=176741&id=176774#toc.