1681864 - Assertion failure during Wasm exception object initialization

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect)

Description

[Asumu Takikawa]

Attachment: 0001-Crashing-test-case-for-event-type-export.patch

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:83.0) Gecko/20100101 Firefox/83.0

Steps to reproduce:

The attached patch contains a test case for the import-export.js jit-test for Wasm exceptions that triggers a crash due to an assertion failure.

Actual results:

There's a crash because the exception object instantiation needs the EventDesc type, but this access is outside the lifetime of the ValTypeVector pointer that's stored in the type.

Comment 1

[Asumu Takikawa]

Attachment: Bug 1681864 - Fix Wasm EventDesc type representation.

Revise the type representation of exception argument types
in EventDesc. This avoids the ValTypeVector pointer in ResultType
from being used out of its lifetime in instantiating event
exports from Wasm modules.

Comment 2

[Asumu Takikawa]

I've attached a possible patch for fixing this, which uses a representation from an old version of https://phabricator.services.mozilla.com/D96681. It avoids the pointer lifetime issue by keeping a copying the FuncType args in the EventDesc instead of keeping the pointer.

I couldn't think of a good way to fix this while keeping the ResultType representation, but if anyone has suggestions for that I would be happy to revise the patch too.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f06ed1eef17d
Fix Wasm EventDesc type representation. r=rhunt

Comment 4

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/f06ed1eef17d

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:asumu, is this bug important enough to require an uplift?
If not please set status_beta to wontfix.

For more information, please visit auto_nag documentation.

Comment 6

[Lars T Hansen [:lth]]

What is this status_beta field of which you speak?

As I understand it, this experimental code is nightly-only and additionally behind a flag. Beta should not be affected.