2006050 - Segmentation fault in checkOffsetAndAlignmentAndBounds(js::wasm::MemoryAccessDesc*, js::jit::MDefinition**) ()

Status: RESOLVED DUPLICATE of bug 2005350

(Core :: JavaScript: WebAssembly, defect)

Description

[tom.online1337]

Attachment: test.js

Steps to reproduce:

The full command that triggered this issue:

js --no-threads --fuzzing-safe test.js

SPIDERMONKEY Version

js --version
JavaScript-C148.0a1

Operating system information

Ubuntu 20.04

Hardware Architecture

amd64 (x86_64)

Actual results:

Segmentation fault (core dumped)

(gdb) r --no-threads --fuzzing-safe test.js
Starting program: /work/harnesses/download-binaries/js --no-threads --fuzzing-safe test.js
warning: Error disabling address space randomization: Operation not permitted
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x70ee6ba00640 (LWP 4180771)]
[Thread 0x70ee6ba00640 (LWP 4180771) exited]

Thread 1 "js" received signal SIGSEGV, Segmentation fault.
0x0000555998314280 in (anonymous namespace)::FunctionCompiler::checkOffsetAndAlignmentAndBounds(js::wasm::MemoryAccessDesc*, js::jit::MDefinition**) ()
(gdb) bt
#0  0x0000555998314280 in (anonymous namespace)::FunctionCompiler::checkOffsetAndAlignmentAndBounds(js::wasm::MemoryAccessDesc*, js::jit::MDefinition**) ()
#1  0x000055599831779e in (anonymous namespace)::FunctionCompiler::load(js::jit::MDefinition*, js::wasm::MemoryAccessDesc*, js::wasm::PackedType<js::wasm::ValTypeTraits>) ()
#2  0x0000555998300d5f in (anonymous namespace)::FunctionCompiler::emitLoad(js::wasm::PackedType<js::wasm::ValTypeTraits>, JS::Scalar::Type) ()
#3  0x00005559982f6860 in (anonymous namespace)::FunctionCompiler::emitBodyExprs() ()
#4  0x00005559982f606c in js::wasm::IonCompileFunctions(js::wasm::CodeMetadata const&, js::wasm::CodeTailMetadata const*, js::wasm::CompilerEnvironment const&, js::LifoAlloc&, mozilla::Vector<js::wasm::FuncCompileInput, 8ul, js::SystemAllocPolicy> const&, js::wasm::CompiledCode*, std::unique_ptr<char [], JS::FreePolicy>*) ()
#5  0x00005559982f54a4 in ExecuteCompileTask(js::wasm::CompileTask*, std::unique_ptr<char [], JS::FreePolicy>*) ()
#6  0x0000555998323089 in js::wasm::ModuleGenerator::locallyCompileCurrentTask() ()
#7  0x00005559982e44f0 in bool DecodeCodeSection<js::wasm::Decoder, js::wasm::ModuleGenerator>(js::wasm::CodeMetadata const&, js::wasm::Decoder&, js::wasm::ModuleGenerator&) ()
#8  0x00005559982e419c in js::wasm::CompileBuffer(js::wasm::CompileArgs const&, js::wasm::BytecodeBufferOrSource const&, std::unique_ptr<char [], JS::FreePolicy>*, mozilla::Vector<std::unique_ptr<char [], JS::FreePolicy>, 0ul, js::SystemAllocPolicy>*, JS::OptimizedEncodingListener*) ()
#9  0x000055599834062d in js::WasmModuleObject::construct(JSContext*, unsigned int, JS::Value*) ()
#10 0x0000555997a3c890 in InternalConstruct(JSContext*, js::AnyConstructArgs const&, js::CallReason) ()
#11 0x0000555997a08c98 in js::Interpret(JSContext*, js::RunState&)
    ()
#12 0x00005559976edb10 in js::RunScript(JSContext*, js::RunState&)
    ()
#13 0x0000555997adc545 in js::Execute(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) ()
#14 0x0000555997adc22e in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) ()
#15 0x0000555997ea4018 in RunFile(JSContext*, char const*, _IO_FILE*, CompileUtf8, bool, bool) ()
#16 0x0000555997ea2fc3 in Process(JSContext*, char const*, bool, FileKind) ()
#17 0x0000555997e9042f in main ()

Comment 1

[Ryan Hunt [:rhunt] (PTO Sept 7-11)]

I'm guessing this is related to the custom page sizes patches that landed recently in bug 1977854.

Comment 2

[Ben Visness [:bvisness]]

I believe this is another case of running Ion with custom page sizes enabled.