1721997 - Assertion failure: mRawPtr != nullptr (You can't dereference a NULL RefPtr with operator->().), at mozilla/RefPtr.h:315 or Crash [@ js::wasm::CompileIntrinsicModule]

Status: VERIFIED FIXED

(Core :: JavaScript: WebAssembly, defect, P2)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20210722-1979267c2a7f (--enable-debug build, run with --fuzzing-safe --ion-offthread-compile=off --wasm-compiler=optimized --more-compartments test.js):

a = newGlobal()
function b(c) {
    a.Debugger(c)
}
b({})
wasmIntrinsicI8VecMul()

Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  0x58b73aff in js::wasm::CompileIntrinsicModule(JSContext*, js::wasm::IntrinsicOp, JS::MutableHandle<js::WasmModuleObject*>) ()
#1  0x58051573 in WasmIntrinsicI8VecMul(JSContext*, unsigned int, JS::Value*) ()
#2  0x57b283c9 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&amp;) ()
[...]
#13 0x579abff0 in Shell(JSContext*, js::cli::OptionParser*) ()
#14 0x579a3372 in main ()
eax	0x566adc1d	1449843741
ebx	0x58ff458c	1493124492
ecx	0x58ff5f34	1493131060
edx	0xf7bffcc7	-138412857
esi	0xffdf1180	-2158208
edi	0x1	1
ebp	0xffdf2098	4292812952
esp	0xffdf1100	4292808960
eip	0x58b73aff <js::wasm::CompileIntrinsicModule(JSContext*, js::wasm::IntrinsicOp, JS::MutableHandle<js::WasmModuleObject*>)+4175>
=> 0x58b73aff <_ZN2js4wasm22CompileIntrinsicModuleEP9JSContextNS0_11IntrinsicOpEN2JS13MutableHandleIPNS_16WasmModuleObjectEEE+4175>:	movl   $0x13b,0x0
   0x58b73b09 <_ZN2js4wasm22CompileIntrinsicModuleEP9JSContextNS0_11IntrinsicOpEN2JS13MutableHandleIPNS_16WasmModuleObjectEEE+4185>:	call   0x57a2b49a <abort>

Likely a shell-only issue with new builtins.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20210727152622-edce65311704.
Failed to bisect testcase (Unable to launch the start build!):

Start: eba7e3ce93822075543bcc764cef7dbc8e9fc5f1 (20200728094725)
End: 1979267c2a7f69a743d039060eb9d0acf1633736 (20210722031648)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=False, coverage=False, valgrind=False, no_opt=False, fuzzilli=False)

Comment 4

[Ryan Hunt [:rhunt]]

Attachment: Bug 1721997 - wasm: Check CompileArgs::build() and correctly report OOM's. r?yury

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/06bf8c7102d2
wasm: Check CompileArgs::build() and correctly report OOM's. r=yury

Comment 6

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/06bf8c7102d2

Comment 7

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20210810032407-06bf8c7102d2.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

:rhunt, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

Comment 9

[Ryan Hunt [:rhunt]]

The testcase failed to be bisected.