1767446 - Assertion failure: tryNote.end > tryNote.begin, at wasm/WasmGenerator.cpp:1000

Status: VERIFIED FIXED

(Core :: JavaScript: WebAssembly, defect, P2)

Description

[Christian Holler (:decoder)]

The attached testcase crashes on mozilla-central revision 20220429-a3002a9b4204 (build with fuzzing-debug, run with --no-threads --fuzzing-safe --ion-warmup-threshold=0 --disable-oom-functions --wasm-compiler=optimized test.js).

Backtrace:

    Assertion failure: tryNote.end > tryNote.begin, at wasm/WasmGenerator.cpp:1000

    ==10361==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x55f415ca10d3 bp 0x7ffe563b4b50 sp 0x7ffe563b4b10 T10361)
        #0 0x55f415ca10d3 in js::wasm::ModuleGenerator::finishMetadataTier() wasm/WasmGenerator.cpp:1000:5
        #1 0x55f415ca2a90 in js::wasm::ModuleGenerator::finishCodeTier() wasm/WasmGenerator.cpp:1059:8
        #2 0x55f415ca47ef in js::wasm::ModuleGenerator::finishModule(js::wasm::ShareableBytes const&, JS::OptimizedEncodingListener*) wasm/WasmGenerator.cpp:1148:29
        #3 0x55f415c6a76d in js::wasm::CompileBuffer(js::wasm::CompileArgs const&, js::wasm::ShareableBytes const&, mozilla::UniquePtr<char [], JS::FreePolicy>*, mozilla::Vector<mozilla::UniquePtr<char [], JS::FreePolicy>, 0ul, js::SystemAllocPolicy>*, JS::OptimizedEncodingListener*) wasm/WasmCompile.cpp:739:13
        #4 0x55f415d060d0 in js::WasmModuleObject::construct(JSContext*, unsigned int, JS::Value*) wasm/WasmJS.cpp:1815:7
        [...]

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Ryan Hunt [:rhunt]]

This can happen due to dead code elimination removing a MWasmCall so that a try note is left with default values. This is harmless (except for this assert) as the default range is empty (begin == end) and will never be selected as the try note to jump to.

We should still fix this to remove these entries, but it's not security sensitive.

Comment 4

[Ryan Hunt [:rhunt]]

Attachment: Bug 1767446 - wasm: Remove empty try notes left from dead code elimination. r?jseward

Comment 5

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220503155751-0b6f31f3ce0b.
The bug appears to have been introduced in the following build range:

Start: 93a25ec951a91b6d6f1b9d5d631d4fa2dac94e26 (20220411232555)
End: 53b0297b7573943417a24c28931ea8e1aff839ac (20220412012705)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=93a25ec951a91b6d6f1b9d5d631d4fa2dac94e26&tochange=53b0297b7573943417a24c28931ea8e1aff839ac

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1752606

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Hi Ryan, is there a real-world user impact to this bug which would make us want to leave it on the radar for 101?

Comment 8

[Ryan Hunt [:rhunt]]

No, this debug assert will not lead to a correctness or security issue in release. The attached patch reworks this code so that we don't trip this assert.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b667d53f7d24
wasm: Remove empty try notes left from dead code elimination. r=jseward

Comment 10

[bszekely]

https://hg.mozilla.org/mozilla-central/rev/b667d53f7d24

Comment 11

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220524093649-a8d14b452547.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.