1894586 - Assertion failure: js::gc::IsCellPointerValid(str), at dist/include/js/Value.h:615

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect, P3)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

function f() {
  wasmDumpIon(
    wasmTextToBinary(
      "(type $x (struct))(global $g (ref null $x) ref.null $x)(func $h)"
    )
  );
  oomTest(f);
}
f();

(gdb) bt
#0  JS::Value::setString (this=0x7fffffffc318, str=0x0) at /home/ubumain/shell-cache/js-dbg-64-linux-x86_64-0c09216614e4/objdir-js/dist/include/js/Value.h:615
#1  0x0000555557874d25 in JS::StringValue (str=0x55555576b596) at /home/ubumain/shell-cache/js-dbg-64-linux-x86_64-0c09216614e4/objdir-js/dist/include/js/Value.h:1187
#2  WasmDumpIon (cx=0x7ffff7639100, argc=<optimized out>, vp=<optimized out>) at /home/ubumain/trees/mozilla-central/js/src/builtin/TestingFunctions.cpp:2124
#3  0x0000166a9739d533 in ?? ()
#4  0x0000000000000000 in ?? ()
(gdb)

Run with --fuzzing-safe --no-threads --no-baseline --no-ion, compile with AR=ar sh ../configure --enable-debug --enable-debug-symbols --with-ccache --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests, tested on m-c rev 0c09216614e4.

Bisection seems to point to some time in March 2024, but it's still running.

Setting s-s as a start, although if this is like bug 1891658, it may be benign, but I'll let Yury confirm.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/013c01e9b424
user:        Ryan Hunt
date:        Tue Mar 12 20:31:33 2024 +0000
summary:     Bug 1869365 - wasm: Add shell function to dump MIR/LIR of wasm function. r=jseward

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1869365

Comment 3

[Yury Delendik (:yury)]

Setting s-s as a start, although if this is like bug 1891658, it may be benign, but I'll let Yury confirm.

Yep. That's exactly like bug 1891658. The author of the code forgot to check output of the StringValue during: args.rval().set(StringValue(out.release(cx)));. The WasmDumpIon is internal test function and will not be called from content code.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

:rhunt, since you are the author of the regressor, bug 1869365, could you take a look?

For more information, please visit BugBot documentation.

Comment 5

[Jan de Mooij [:jandem]]

Ryan is on leave.

Comment 6

[Yury Delendik (:yury)]

Attachment: Bug 1894586 - Add OOM check at WasmDumpIon. r?jpages

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/93a32d491333
Add OOM check at WasmDumpIon. r=jpages

Comment 8

[Aron Cseh]

https://hg.mozilla.org/mozilla-central/rev/93a32d491333