1880770 - Crash [@ __strlen_avx2] or [@ UTF8CharsToString]

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect, P2)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

var x = {};
Object.defineProperty(x, "", {
  enumerable: true,
  get: function () {
    new WebAssembly.Instance(
      new WebAssembly.Module(
        wasmTextToBinary(
          '(func $f (result f32) f32.const 0)(table (export "g") 1 funcref) (elem (i32.const 0) $f)'
        )
      )
    ).exports.g
      .get(0)
      .type(WebAssembly, "", WebAssembly.Module, {});
  },
});
oomTest(function () {
  Object.values(x);
});

(gdb) bt
#0  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:74
#1  0x00005555586e1a78 in UTF8CharsToString (cx=cx@entry=0x7ffff6b2d100, chars=0x0)
    at /home/w11x500-lin/trees/mozilla-central/js/src/wasm/WasmJS.cpp:772
#2  0x00005555586e1727 in ValTypesToArray (cx=cx@entry=0x7ffff6b2d100, valTypes=...)
    at /home/w11x500-lin/trees/mozilla-central/js/src/wasm/WasmJS.cpp:783
#3  0x000055555868a5d8 in FuncTypeToObject (cx=cx@entry=0x7ffff6b2d100, type=...)
    at /home/w11x500-lin/trees/mozilla-central/js/src/wasm/WasmJS.cpp:805
#4  0x000055555869ee8a in WasmFunctionTypeImpl (cx=cx@entry=0x7ffff6b2d100, args=...)
    at /home/w11x500-lin/trees/mozilla-central/js/src/wasm/WasmJS.cpp:4057
#5  0x000055555869f3d2 in JS::CallNonGenericMethod<&(IsWasmFunction(JS::Handle<JS::Value>)), &(WasmFunctionTypeImpl(JSContext*, JS::CallArgs const&))> (cx=0x7ffff6b2d100, args=...)
    at /home/w11x500-lin/shell-cache/js-dbg-64-linux-x86_64-2af34b4c9adf/objdir-js/dist/include/js/CallNonGenericMethod.h:103
#6  WasmFunctionType (cx=0x7ffff6b2d100, argc=<optimized out>, vp=<optimized out>)
    at /home/w11x500-lin/trees/mozilla-central/js/src/wasm/WasmJS.cpp:4067
#7  0x000007535501a3ec in ?? ()
#8  0xaaaaaa0100015905 in ?? ()
#9  0x00007fffffffb800 in ?? ()
#10 0x0000000000000000 in ?? ()
(gdb)

Run with --fuzzing-safe --no-threads --no-baseline --no-ion, compile with AR=ar sh ../configure --enable-debug --enable-debug-symbols --with-ccache --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests, tested on m-c rev 2af34b4c9adf.

This seems to go as far back as 3 months prior, I'll keep trying to bisect. Let me know if this is a benign OOM issue.

Setting s-s to be safe. Yury/Jan, I'm guessing it's WebAssembly here, the patch for bug 1878673 seems to not fix this issue so it might be a separate issue.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/a8a44a065f73
user:        Lars T Hansen
date:        Tue Feb 08 07:42:28 2022 +0000
summary:     Bug 1753061 - revert bug 1742053 part 11. r=rhunt

It seems to point to a revert but I'm guessing it may (or may not) be related to bug 1753061 or bug 1742053 then. I'll let Yury/Ryan set the regressor here.

(Also setting needinfo? from Ryan)

Comment 2

[Yury Delendik (:yury)]

It looks like wasm::ToString is using DuplicateString and may return nullptr (in this case, during oomTest). Subsequent operations may dereference nullptr, e.g. UTF8CharsToString, and crash. Triaging similar to the bug 1878673.

Comment 3

[Ryan Hunt [:rhunt]]

Yes, agree with Yury. This is caused by OOM conditions. In these cases we'll always have a safe nullptr crash, so this should not be sec-sensitive.

The function called is also in a nightly-only feature (js-type-reflection).

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Setting a needinfo? on Ryan as requested by Yury. No immediate rush, but a patch would be nice! :)

Comment 5

[Yury Delendik (:yury)]

Attachment: Bug 1880770 - Protect UTF8CharsToString from OOM. r?rhunt

Comment 6

[Yury Delendik (:yury)]

Attachment: Bug 1880770 - Check proper handling of OOM during segments creation. r?rhunt

Depends on D203336

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cee87f81024b
Protect UTF8CharsToString from OOM. r=rhunt
https://hg.mozilla.org/integration/autoland/rev/e91a65ccf1f0
Check proper handling of OOM during segments creation. r=rhunt

Comment 8

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/cee87f81024b
https://hg.mozilla.org/mozilla-central/rev/e91a65ccf1f0