1924414 - Assertion failure: js::gc::IsCellPointerValid(bi), at dist/include/js/Value.h:627

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect, P3)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: debug stack

function g() {
  new WebAssembly.Memory({ initial: BigInt(0), index: "i64" }).grow(BigInt(0));
  oomTest(g);
}
g();

627         MOZ_ASSERT(js::gc::IsCellPointerValid(bi));
(gdb) bt
#0  JS::Value::setBigInt (this=0x7fffffffc200, bi=0x0) at /home/yksubu/shell-cache/js-dbg-64-linux-x86_64-d0454173ade6/objdir-js/dist/include/js/Value.h:627
#1  0x0000555558756358 in JS::BigIntValue (bi=0x555555777677) at /home/yksubu/shell-cache/js-dbg-64-linux-x86_64-d0454173ade6/objdir-js/dist/include/js/Value.h:1199
#2  IndexValue (cx=cx@entry=0x7ffff6b37000, value=value@entry=0, indexType=<optimized out>) at /home/yksubu/trees/mozilla-central/js/src/wasm/WasmJS.cpp:628
#3  0x0000555558755feb in js::WasmMemoryObject::growImpl (cx=cx@entry=0x7ffff6b37000, args=...) at /home/yksubu/trees/mozilla-central/js/src/wasm/WasmJS.cpp:2254
#4  0x0000555558756548 in JS::CallNonGenericMethod<&(IsMemory(JS::Handle<JS::Value>)), &js::WasmMemoryObject::growImpl> (cx=0x7ffff6b37000, args=...) at /home/yksubu/shell-cache/js-dbg-64-linux-x86_64-d0454173ade6/objdir-js/dist/include/js/CallNonGenericMethod.h:103
#5  js::WasmMemoryObject::grow (cx=cx@entry=0x7ffff6b37000, argc=<optimized out>, vp=<optimized out>) at /home/yksubu/trees/mozilla-central/js/src/wasm/WasmJS.cpp:2261
/snip

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/8f4fb6c25a2d
user:        Ben Visness
date:        Mon Aug 26 20:49:39 2024 +0000
summary:     Bug 1913350: Use BigInt for memory64 params/results. r=rhunt

Run with --fuzzing-safe --no-threads --no-baseline --no-ion, compile with AR=ar sh ../configure --enable-debug --enable-debug-symbols --with-ccache --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests, tested on m-c rev d0454173ade6.

Setting s-s just in case. Ben, is bug 1913350 a likely regressor?

Comment 1

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1913350

Comment 2

[Ben Visness [:bvisness]]

Yes, bug 1913350 seems like the obvious regressor. I'll take a look.

Comment 3

[Ben Visness [:bvisness]]

Attachment: Bug 1924414: Handle BigInt allocation failures in IndexValue. r=rhunt

We simply were not handling the case where BigInt::createFromUint64
returns nullptr (which it always does under OOM conditions).

Comment 4

[Ryan Hunt [:rhunt] (PTO Sept 7-11)]

This is a bug in our OOM handling. The worst case is that we create a tagged big int JS::Value which actually points to nullptr instead of a valid JS::BigInt value. The size of a JS::BigInt is 16 bytes [1], so any access to this value will always be well within the null page for a guaranteed crash.

[1] https://searchfox.org/mozilla-central/rev/d56687458d4e6e8882c4b740e78413a0f0a69d59/js/src/vm/BigIntType.h#488

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f79b56c5c761
Handle BigInt allocation failures in IndexValue. r=rhunt

Comment 6

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/f79b56c5c761

Comment 7

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:bvisness, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox132 to wontfix.

For more information, please visit BugBot documentation.