1791992 - Assertion failure: mRawPtr != nullptr in js::wasm::CompileIntrinsicModule

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, task, P3)

Description

[Samuel Groß]

The following program triggers a debug assertion failure in debug builds from latest HEAD:

function main() {
let v1 = 255;
do {
    try {
        const v3 = this.oomAtAllocation(v1);
        const v4 = this;
        const v6 = {};
        const v8 = new Proxy(this,v6);
        const v10 = v8 >= 9007199254740990n;
        const v11 = this.wasmIntrinsicI8VecMul();
    } catch(v12) {
    }
    const v13 = v1++;
} while (0 < v1);
gc();
}
main();
// CRASH INFO
// ==========
// TERMSIG: 11
// STDERR:
// Assertion failure: mRawPtr != nullptr (You can't dereference a NULL RefPtr with operator*().), at /home/builder/firefox/obj-fuzzbuild/dist/include/mozilla/RefPtr.h:358
// #01: ???[./spidermonkey/js +0x2ca327c]
// #02: ???[./spidermonkey/js +0x1ec646a]
// #03: ??? (???:???)

Here is the stacktrace from gdb:

#0  0x0000555558ae5216 in RefPtr<js::wasm::ShareableBytes const>::operator* (this=0x7fffffff8460) at obj-debug/dist/include/mozilla/RefPtr.h:357
#1  0x0000555558b56dce in js::wasm::CompileIntrinsicModule (cx=0x7ffff772fc00, ids=..., sharedMemory=js::wasm::Shareable::False, result=...) at js/src/wasm/WasmIntrinsic.cpp:219
#2  0x0000555557b9f516 in WasmIntrinsicI8VecMul (cx=0x7ffff772fc00, argc=0, vp=0x7fffffff9a70) at js/src/builtin/TestingFunctions.cpp:1974
#3  0x000016ec68f092be in ?? ()
# ...
#7  0x0000000000000000 in ?? ()

Comment 1

[Ryan Hunt [:rhunt]]

Attachment: Bug 1791992 - wasm: Fix OOM handling in CompileIntrinsicModule. r?yury

Comment 2

[Ryan Hunt [:rhunt]]

Our OOM handling was incomplete in this function. This is limited to only the JS shell.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4ecf57a3aaa6
wasm: Fix OOM handling in CompileIntrinsicModule. r=yury

Comment 5

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/4ecf57a3aaa6