1977469 - Assertion failure: cx->isExceptionPending() || cx->isPropagatingForcedReturn() || cx->hadUncatchableException(), at vm/Interpreter.cpp:402

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: debug stack

BigInt64Array.importedStringConstants = 0;
function f() {
  new WebAssembly.Module(
    wasmTextToBinary(
      "(type $a (array (mut i32)))(func (param i32)(result eqref) local.get 0 array.new_default $a)",
    ),
    BigInt64Array,
  );
  oomTest(f);
}
f();

(gdb) bt
#0  0x00005555572ae7c9 in MOZ_CrashSequence (aAddress=0x0, aLine=402) at /home/msf2/shell-cache/js-dbg-64-linux-x86_64-8b4dd515e78c/objdir-js/dist/include/mozilla/Assertions.h:248
#1  AssertExceptionResult (cx=cx@entry=0x7ffff5e2a200) at /home/msf2/trees/mozilla-central/js/src/vm/Interpreter.cpp:401
#2  0x00005555572d516f in CallJSNative (cx=cx@entry=0x7ffff5e2a200, native=native@entry=0x555558763e80 <js::WasmModuleObject::construct(JSContext*, unsigned int, JS::Value*)>,
    reason=reason@entry=js::CallReason::Call, args=...) at /home/msf2/trees/mozilla-central/js/src/vm/Interpreter.cpp:506
#3  0x00005555572ddbcd in CallJSNativeConstructor (cx=cx@entry=0x7ffff5e2a200, native=0x555558763e80 <js::WasmModuleObject::construct(JSContext*, unsigned int, JS::Value*)>, args=...)
    at /home/msf2/trees/mozilla-central/js/src/vm/Interpreter.cpp:519
#4  0x00005555572b027a in InternalConstruct (cx=cx@entry=0x7ffff5e2a200, args=..., reason=reason@entry=js::CallReason::Call)
    at /home/msf2/trees/mozilla-central/js/src/vm/Interpreter.cpp:725
#5  0x00005555572bebfd in js::ConstructFromStack (cx=0x7ffff5e2a200, args=..., reason=<optimized out>) at /home/msf2/trees/mozilla-central/js/src/vm/Interpreter.cpp:772
/snip

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/b3e3e654d030
user:        Ryan Hunt
date:        Tue Nov 19 16:14:04 2024 +0000
summary:     Bug 1913964 - wasm: Ship js-string-builtins. r=bvisness,yury

Run with --fuzzing-safe --no-threads --no-baseline --no-ion, compile with AR=ar sh ../configure --enable-debug --enable-debug-symbols --with-ccache --enable-nspr-build --enable-ctypes --enable-gczeal --enable-rust-simd --disable-tests, tested on m-c rev 8b4dd515e78c.

Ryan, is bug 1913964 a likely regressor?

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1913964

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Run with --setpref=wasm_js_string_builtins=true and bisection points to:

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/de8b96102f94
user:        Jan de Mooij
date:        Tue Oct 01 11:02:38 2024 +0000
summary:     Bug 1921780 - Improve exception handling assertions in the JS shell. r=arai

Comment 3

[Daniel Veditz [:dveditz]]

None of the regressions from bug 1921780 so far have been considered security problems.

Comment 4

[Jan de Mooij [:jandem]]

An OOM buglet in FeatureOptions::init.

Comment 5

[Jan de Mooij [:jandem]]

Attachment: Bug 1977469 - Use cx->new_ in FeatureOptions::init to ensure OOM is reported on the context. r?rhunt!

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/641061404fec
https://hg.mozilla.org/integration/autoland/rev/412f16d74ce9
Use cx->new_ in FeatureOptions::init to ensure OOM is reported on the context. r=rhunt

Comment 7

[pstanciu]

https://hg.mozilla.org/mozilla-central/rev/412f16d74ce9

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:jandem, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox142 to wontfix.

For more information, please visit BugBot documentation.