263965 2023-10-31 07:25:25 -0700 Concurrency bug in WebAssembly LLInt compilation 2024-08-14 14:07:53 -0700 1 1 1 Unclassified WebKit JavaScriptCore Other Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=267686 InRadar P2 Normal --- 1 ian.grunert webkit-unassigned fujii justin_michaud keith_miller mark.lam max webkit-bug-importer oldest_to_newest 1988828 0 ian.grunert 2023-10-31 07:25:25 -0700 On Windows, I reliably hit a heap corruption error on the release build when running the async clock yew wasm example (https://examples.yew.rs/async_clock/). The heap corruption is discovered when resizing a vector for the microtasks queue. It looks like it's a concurrency bug in WebAssembly LLInt compilation, which triggers on my machine because it has 16 cores / 24 threads. It doesn't happen if I reduce the numberOfWasmCompilerThreads in OptionsList.h. Might be something in WebAssembly LLInt compilation using a shared Vector without a lock. I suspect this isn't a Windows specific issue and may impact all platforms. 1988863 1 468427 ian.grunert 2023-10-31 09:26:47 -0700 Created attachment 468427 Stack trace 1990507 2 webkit-bug-importer 2023-11-07 06:26:13 -0800 <rdar://problem/118054777> 1999165 3 ian.grunert 2023-12-12 18:29:20 -0800 I spent some time looking at this today. On a release build, I was able to repro this even with a single wasm compiler thread. With the logging enabled for WasmEntryPlan and WasmWorklist, on a single thread it was able to complete wasm compilation - crashed afterwards with the same stack trace as before. Couldn't repro on Gnome Web running under WSL. No problems running JetStream2, I wonder if it's something to do with the number of functions involved (520). 1999450 4 469029 fujii 2023-12-13 17:37:50 -0800 Created attachment 469029 workaround patch 1999485 5 469035 fujii 2023-12-13 20:54:16 -0800 Created attachment 469035 WIP patch 1999750 6 469050 fujii 2023-12-14 15:58:16 -0800 Created attachment 469050 WIP patch 1999752 7 justin_michaud 2023-12-14 16:01:32 -0800 @Fujii Hironori Nice catch! r=me 1999772 8 fujii 2023-12-14 17:06:55 -0800 I'm not confident this is clang's bug. This might be a JSC bug. JSC may break callee saved registers. 2052811 9 ian.grunert 2024-08-14 14:07:53 -0700 The example site is broken now, I raised a bug against yew https://github.com/yewstack/yew/issues/3694 If you disable subresource integrity checking, the example loads and no longer hits a heap corruption error. 468427 2023-10-31 09:26:47 -0700 2023-10-31 09:26:47 -0700 Stack trace stacktrace.txt text/plain 4018 ian.grunert VW5oYW5kbGVkIGV4Y2VwdGlvbiBhdCAweDAwMDA3RkZEMEVDNUM4NDkgKG50ZGxsLmRsbCkgaW4g V2ViS2l0V2ViUHJvY2Vzcy5leGU6IDB4QzAwMDAzNzQ6IEEgaGVhcCBoYXMgYmVlbiBjb3JydXB0 ZWQgKHBhcmFtZXRlcnM6IDB4MDAwMDdGRkQwRUNEMzhBMCkuCgogCW50ZGxsLmRsbCEwMDAwN2Zm ZDBlYzVjODQ5KCkJVW5rbm93bgogCW50ZGxsLmRsbCEwMDAwN2ZmZDBlYzVjODEzKCkJVW5rbm93 bgogCW50ZGxsLmRsbCEwMDAwN2ZmZDBlYzY1OGFhKCkJVW5rbm93bgogCW50ZGxsLmRsbCEwMDAw N2ZmZDBlYzY1YjhhKCkJVW5rbm93bgogCW50ZGxsLmRsbCEwMDAwN2ZmZDBlYzcxYjg1KCkJVW5r bm93bgogCW50ZGxsLmRsbCEwMDAwN2ZmZDBlYjhiZWJjKCkJVW5rbm93bgogCW50ZGxsLmRsbCEw MDAwN2ZmZDBlYjhhYjAxKCkJVW5rbm93bgogCXVjcnRiYXNlLmRsbCEwMDAwN2ZmZDBjMDUzN2Vi KCkJVW5rbm93bgo+CVtJbmxpbmUgRnJhbWVdIFdlYkNvcmUuZGxsIVdURjo6RmFzdE1hbGxvYzo6 ZnJlZSh2b2lkICogcCkgTGluZSAyNTEJQysrCiAJW0lubGluZSBGcmFtZV0gV2ViQ29yZS5kbGwh V1RGOjpWZWN0b3JCdWZmZXJCYXNlPHN0ZDo6dW5pcXVlX3B0cjxXZWJDb3JlOjpFdmVudExvb3BU YXNrLHN0ZDo6ZGVmYXVsdF9kZWxldGU8V2ViQ29yZTo6RXZlbnRMb29wVGFzaz4+LFdURjo6RmFz dE1hbGxvYz46OmRlYWxsb2NhdGVCdWZmZXIoc3RkOjp1bmlxdWVfcHRyPFdlYkNvcmU6OkV2ZW50 TG9vcFRhc2ssc3RkOjpkZWZhdWx0X2RlbGV0ZTxXZWJDb3JlOjpFdmVudExvb3BUYXNrPj4gKiBi dWZmZXJUb0RlYWxsb2NhdGUpIExpbmUgMzYxCUMrKwogCVtJbmxpbmUgRnJhbWVdIFdlYkNvcmUu ZGxsIVdURjo6VmVjdG9yPHN0ZDo6dW5pcXVlX3B0cjxXZWJDb3JlOjpFdmVudExvb3BUYXNrLHN0 ZDo6ZGVmYXVsdF9kZWxldGU8V2ViQ29yZTo6RXZlbnRMb29wVGFzaz4+LDAsV1RGOjpDcmFzaE9u T3ZlcmZsb3csMTYsV1RGOjpGYXN0TWFsbG9jPjo6cmVzZXJ2ZUNhcGFjaXR5KHVuc2lnbmVkIF9f aW50NjQgbmV3Q2FwYWNpdHkpIExpbmUgMTM0MQlDKysKIAlbSW5saW5lIEZyYW1lXSBXZWJDb3Jl LmRsbCFXVEY6OlZlY3RvcjxzdGQ6OnVuaXF1ZV9wdHI8V2ViQ29yZTo6RXZlbnRMb29wVGFzayxz dGQ6OmRlZmF1bHRfZGVsZXRlPFdlYkNvcmU6OkV2ZW50TG9vcFRhc2s+PiwwLFdURjo6Q3Jhc2hP bk92ZXJmbG93LDE2LFdURjo6RmFzdE1hbGxvYz46OmV4cGFuZENhcGFjaXR5KHVuc2lnbmVkIF9f aW50NjQgbmV3TWluQ2FwYWNpdHkpIExpbmUgMTE4NglDKysKIAlXZWJDb3JlLmRsbCFXVEY6OlZl Y3RvcjxzdGQ6OnVuaXF1ZV9wdHI8V2ViQ29yZTo6RXZlbnRMb29wVGFzayxzdGQ6OmRlZmF1bHRf ZGVsZXRlPFdlYkNvcmU6OkV2ZW50TG9vcFRhc2s+PiwwLFdURjo6Q3Jhc2hPbk92ZXJmbG93LDE2 LFdURjo6RmFzdE1hbGxvYz46OmV4cGFuZENhcGFjaXR5PDA+KHVuc2lnbmVkIF9faW50NjQgbmV3 TWluQ2FwYWNpdHksIHN0ZDo6dW5pcXVlX3B0cjxXZWJDb3JlOjpFdmVudExvb3BUYXNrLHN0ZDo6 ZGVmYXVsdF9kZWxldGU8V2ViQ29yZTo6RXZlbnRMb29wVGFzaz4+ICogcHRyKSBMaW5lIDEyMTEJ QysrCiAJW0lubGluZSBGcmFtZV0gV2ViQ29yZS5kbGwhV1RGOjpWZWN0b3I8c3RkOjp1bmlxdWVf cHRyPFdlYkNvcmU6OkV2ZW50TG9vcFRhc2ssc3RkOjpkZWZhdWx0X2RlbGV0ZTxXZWJDb3JlOjpF dmVudExvb3BUYXNrPj4sMCxXVEY6OkNyYXNoT25PdmVyZmxvdywxNixXVEY6OkZhc3RNYWxsb2M+ OjphcHBlbmRTbG93Q2FzZShzdGQ6OnVuaXF1ZV9wdHI8V2ViQ29yZTo6RXZlbnRMb29wVGFzayxz dGQ6OmRlZmF1bHRfZGVsZXRlPFdlYkNvcmU6OkV2ZW50TG9vcFRhc2s+PiAmJiB2YWx1ZSkgTGlu ZSAxNDg5CUMrKwogCVtJbmxpbmUgRnJhbWVdIFdlYkNvcmUuZGxsIVdURjo6VmVjdG9yPHN0ZDo6 dW5pcXVlX3B0cjxXZWJDb3JlOjpFdmVudExvb3BUYXNrLHN0ZDo6ZGVmYXVsdF9kZWxldGU8V2Vi Q29yZTo6RXZlbnRMb29wVGFzaz4+LDAsV1RGOjpDcmFzaE9uT3ZlcmZsb3csMTYsV1RGOjpGYXN0 TWFsbG9jPjo6YXBwZW5kKHN0ZDo6dW5pcXVlX3B0cjxXZWJDb3JlOjpFdmVudExvb3BUYXNrLHN0 ZDo6ZGVmYXVsdF9kZWxldGU8V2ViQ29yZTo6RXZlbnRMb29wVGFzaz4+ICYmIHZhbHVlKSBMaW5l IDE0NjQJQysrCiAJW0lubGluZSBGcmFtZV0gV2ViQ29yZS5kbGwhV1RGOjpWZWN0b3I8c3RkOjp1 bmlxdWVfcHRyPFdlYkNvcmU6OkV2ZW50TG9vcFRhc2ssc3RkOjpkZWZhdWx0X2RlbGV0ZTxXZWJD b3JlOjpFdmVudExvb3BUYXNrPj4sMCxXVEY6OkNyYXNoT25PdmVyZmxvdywxNixXVEY6OkZhc3RN YWxsb2M+OjphcHBlbmQoc3RkOjp1bmlxdWVfcHRyPFdlYkNvcmU6OkV2ZW50TG9vcFRhc2ssc3Rk OjpkZWZhdWx0X2RlbGV0ZTxXZWJDb3JlOjpFdmVudExvb3BUYXNrPj4gJiYgdSkgTGluZSA4NTYJ QysrCiAJW0lubGluZSBGcmFtZV0gV2ViQ29yZS5kbGwhV1RGOjpWZWN0b3I8c3RkOjp1bmlxdWVf cHRyPFdlYkNvcmU6OkV2ZW50TG9vcFRhc2ssc3RkOjpkZWZhdWx0X2RlbGV0ZTxXZWJDb3JlOjpF dmVudExvb3BUYXNrPj4sMCxXVEY6OkNyYXNoT25PdmVyZmxvdywxNixXVEY6OkZhc3RNYWxsb2M+ OjphcHBlbmQoc3RkOjp1bmlxdWVfcHRyPFdlYkNvcmU6OkV2ZW50TG9vcFRhc2ssc3RkOjpkZWZh dWx0X2RlbGV0ZTxXZWJDb3JlOjpFdmVudExvb3BUYXNrPj4gJiYgdmFsdWUpIExpbmUgODU2CUMr KwogCVdlYkNvcmUuZGxsIVdlYkNvcmU6Ok1pY3JvdGFza1F1ZXVlOjphcHBlbmQoc3RkOjp1bmlx dWVfcHRyPFdlYkNvcmU6OkV2ZW50TG9vcFRhc2ssc3RkOjpkZWZhdWx0X2RlbGV0ZTxXZWJDb3Jl OjpFdmVudExvb3BUYXNrPj4gJiYgdGFzaykgTGluZSA0OAlDKysKIAlbSW5saW5lIEZyYW1lXSBX ZWJDb3JlLmRsbCFXZWJDb3JlOjpFdmVudExvb3A6OnF1ZXVlTWljcm90YXNrKHN0ZDo6dW5pcXVl X3B0cjxXZWJDb3JlOjpFdmVudExvb3BUYXNrLHN0ZDo6ZGVmYXVsdF9kZWxldGU8V2ViQ29yZTo6 RXZlbnRMb29wVGFzaz4+ICYmIG1pY3JvdGFzaykgTGluZSAyNDYJQysrCiAJV2ViQ29yZS5kbGwh V2ViQ29yZTo6RXZlbnRMb29wVGFza0dyb3VwOjpxdWV1ZU1pY3JvdGFzayhXVEY6OkZ1bmN0aW9u PHZvaWQgKCk+ICYmIGZ1bmN0aW9uKSBMaW5lIDQ3OAlDKysKIAlXZWJDb3JlLmRsbCFXZWJDb3Jl OjpKU0RPTVdpbmRvd0Jhc2U6OnF1ZXVlTWljcm90YXNrVG9FdmVudExvb3AoSlNDOjpKU0dsb2Jh bE9iamVjdCAmIG9iamVjdCwgV1RGOjpSZWY8SlNDOjpNaWNyb3Rhc2ssV1RGOjpSYXdQdHJUcmFp dHM8SlNDOjpNaWNyb3Rhc2s+PiAmJiB0YXNrKSBMaW5lIDI0OQlDKysKIAlbSW5saW5lIEZyYW1l XSBKYXZhU2NyaXB0Q29yZS5kbGwhSlNDOjpKU0dsb2JhbE9iamVjdDo6cXVldWVNaWNyb3Rhc2so V1RGOjpSZWY8SlNDOjpNaWNyb3Rhc2ssV1RGOjpSYXdQdHJUcmFpdHM8SlNDOjpNaWNyb3Rhc2s+ PiAmJiB0YXNrKSBMaW5lIDMwMDkJQysrCiAJSmF2YVNjcmlwdENvcmUuZGxsIUpTQzo6SlNHbG9i YWxPYmplY3Q6OnF1ZXVlTWljcm90YXNrKEpTQzo6SlNWYWx1ZSBqb2IsIEpTQzo6SlNWYWx1ZSBh cmd1bWVudDAsIEpTQzo6SlNWYWx1ZSBhcmd1bWVudDEsIEpTQzo6SlNWYWx1ZSBhcmd1bWVudDIs IEpTQzo6SlNWYWx1ZSBhcmd1bWVudDMpIExpbmUgMzAxOAlDKysKIAlKYXZhU2NyaXB0Q29yZS5k bGwhSlNDOjplbnF1ZXVlSm9iKEpTQzo6SlNHbG9iYWxPYmplY3QgKiBnbG9iYWxPYmplY3QsIEpT Qzo6Q2FsbEZyYW1lICogY2FsbEZyYW1lKSBMaW5lIDY1NwlDKysKIAkwMDAwMDE4OTJiNTIxNGRl KCkJVW5rbm93bgogCTAwMDAwMTg5NmJhN2NmYTgoKQlVbmtub3duCiAJMDAwMDYzZWViOTYwNGIz MygpCVVua25vd24KIAkwMDAwMDE4OTZmODYxZmQwKCkJVW5rbm93bgogCTAwMDAwMDU1MGM5OGUy OTAoKQlVbmtub3duCiAJMDAwMDAwNTUwYzk4ZTI3MCgpCVVua25vd24KIAlKYXZhU2NyaXB0Q29y ZS5kbGwhbGxpbnRfZW50cnkoKQlVbmtub3duCg== 469029 2023-12-13 17:37:50 -0800 2023-12-13 20:54:26 -0800 workaround patch workaround.patch text/plain 839 fujii ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2RvbS9NaWNyb3Rhc2tzLmNwcCBiL1NvdXJjZS9X ZWJDb3JlL2RvbS9NaWNyb3Rhc2tzLmNwcA0KaW5kZXggNzU5M2U0MWQzYWZlLi5hODIxMzNiMDY0 MTQgMTAwNjQ0DQotLS0gYS9Tb3VyY2UvV2ViQ29yZS9kb20vTWljcm90YXNrcy5jcHANCisrKyBi L1NvdXJjZS9XZWJDb3JlL2RvbS9NaWNyb3Rhc2tzLmNwcA0KQEAgLTYwLDcgKzYwLDEwIEBAIHZv aWQgTWljcm90YXNrUXVldWU6OnBlcmZvcm1NaWNyb3Rhc2tDaGVja3BvaW50KCkNCiANCiAgICAg VmVjdG9yPHN0ZDo6dW5pcXVlX3B0cjxFdmVudExvb3BUYXNrPj4gdG9LZWVwOw0KICAgICB3aGls ZSAoIW1fbWljcm90YXNrUXVldWUuaXNFbXB0eSgpICYmICF2bS0+ZXhlY3V0aW9uRm9yYmlkZGVu KCkpIHsNCi0gICAgICAgIFZlY3RvcjxzdGQ6OnVuaXF1ZV9wdHI8RXZlbnRMb29wVGFzaz4+IHF1 ZXVlID0gV1RGTW92ZShtX21pY3JvdGFza1F1ZXVlKTsNCisgICAgICAgIFZlY3RvcjxzdGQ6OnVu aXF1ZV9wdHI8RXZlbnRMb29wVGFzaz4+IHF1ZXVlID0gc3RkOjpleGNoYW5nZShtX21pY3JvdGFz a1F1ZXVlLCB7fSk7DQorI2lmIE9TKFdJTkRPV1MpIC8vIHdvcmthcm91bmQgZm9yIGEgY29tcGls ZXIgYnVnPw0KKyAgICAgICAgbV9taWNyb3Rhc2tRdWV1ZS5yZXNlcnZlQ2FwYWNpdHkoMSk7DQor I2VuZGlmICAgICAgICANCiAgICAgICAgIGZvciAoYXV0byYgdGFzayA6IHF1ZXVlKSB7DQogICAg ICAgICAgICAgYXV0byogZ3JvdXAgPSB0YXNrLT5ncm91cCgpOw0KICAgICAgICAgICAgIGlmICgh Z3JvdXAgfHwgZ3JvdXAtPmlzU3RvcHBlZFBlcm1hbmVudGx5KCkpDQo= 469035 2023-12-13 20:54:16 -0800 2023-12-13 20:54:16 -0800 WIP patch wip.patch text/plain 560 fujii ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2RvbS9NaWNyb3Rhc2tzLmNwcCBiL1NvdXJjZS9X ZWJDb3JlL2RvbS9NaWNyb3Rhc2tzLmNwcA0KaW5kZXggNzU5M2U0MWQzYWZlLi41NjZkZjQxZWUz MjUgMTAwNjQ0DQotLS0gYS9Tb3VyY2UvV2ViQ29yZS9kb20vTWljcm90YXNrcy5jcHANCisrKyBi L1NvdXJjZS9XZWJDb3JlL2RvbS9NaWNyb3Rhc2tzLmNwcA0KQEAgLTQ4LDYgKzQ4LDkgQEAgdm9p ZCBNaWNyb3Rhc2tRdWV1ZTo6YXBwZW5kKHN0ZDo6dW5pcXVlX3B0cjxFdmVudExvb3BUYXNrPiYm IHRhc2spDQogICAgIG1fbWljcm90YXNrUXVldWUuYXBwZW5kKFdURk1vdmUodGFzaykpOw0KIH0N CiANCisjaWYgT1MoV0lORE9XUykgJiYgQ09NUElMRVIoQ0xBTkcpIC8vIFdvcmsgYXJvdW5kIENs YW5nJ3Mgb3B0aW1pemluZyBjb21waWxlciBidWcuDQorW1tjbGFuZzo6b3B0bm9uZV1dDQorI2Vu ZGlmDQogdm9pZCBNaWNyb3Rhc2tRdWV1ZTo6cGVyZm9ybU1pY3JvdGFza0NoZWNrcG9pbnQoKQ0K IHsNCiAgICAgaWYgKG1fcGVyZm9ybWluZ01pY3JvdGFza0NoZWNrcG9pbnQpDQo= 469050 2023-12-14 15:58:16 -0800 2023-12-14 16:01:53 -0800 WIP patch wip.patch text/plain 1080 fujii ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2RvbS9NaWNyb3Rhc2tzLmNwcCBiL1NvdXJjZS9X ZWJDb3JlL2RvbS9NaWNyb3Rhc2tzLmNwcA0KaW5kZXggNzU5M2U0MWQzYWZlLi43ZjBkYTdlNTg4 NmYgMTAwNjQ0DQotLS0gYS9Tb3VyY2UvV2ViQ29yZS9kb20vTWljcm90YXNrcy5jcHANCisrKyBi L1NvdXJjZS9XZWJDb3JlL2RvbS9NaWNyb3Rhc2tzLmNwcA0KQEAgLTQ4LDYgKzQ4LDEwIEBAIHZv aWQgTWljcm90YXNrUXVldWU6OmFwcGVuZChzdGQ6OnVuaXF1ZV9wdHI8RXZlbnRMb29wVGFzaz4m JiB0YXNrKQ0KICAgICBtX21pY3JvdGFza1F1ZXVlLmFwcGVuZChXVEZNb3ZlKHRhc2spKTsNCiB9 DQogDQorI2lmIE9TKFdJTkRPV1MpICYmIENPTVBJTEVSKENMQU5HKSAvLyBXb3JrIGFyb3VuZCBD bGFuZydzIG9wdGltaXppbmcgY29tcGlsZXIgYnVnLg0KK3ZvaWQqIHNHbG9iYWxRdWV1ZVB0cjsN CisjZW5kaWYNCisgICAgDQogdm9pZCBNaWNyb3Rhc2tRdWV1ZTo6cGVyZm9ybU1pY3JvdGFza0No ZWNrcG9pbnQoKQ0KIHsNCiAgICAgaWYgKG1fcGVyZm9ybWluZ01pY3JvdGFza0NoZWNrcG9pbnQp DQpAQCAtNjEsNiArNjUsOSBAQCB2b2lkIE1pY3JvdGFza1F1ZXVlOjpwZXJmb3JtTWljcm90YXNr Q2hlY2twb2ludCgpDQogICAgIFZlY3RvcjxzdGQ6OnVuaXF1ZV9wdHI8RXZlbnRMb29wVGFzaz4+ IHRvS2VlcDsNCiAgICAgd2hpbGUgKCFtX21pY3JvdGFza1F1ZXVlLmlzRW1wdHkoKSAmJiAhdm0t PmV4ZWN1dGlvbkZvcmJpZGRlbigpKSB7DQogICAgICAgICBWZWN0b3I8c3RkOjp1bmlxdWVfcHRy PEV2ZW50TG9vcFRhc2s+PiBxdWV1ZSA9IFdURk1vdmUobV9taWNyb3Rhc2tRdWV1ZSk7DQorI2lm IE9TKFdJTkRPV1MpICYmIENPTVBJTEVSKENMQU5HKQ0KKyAgICAgICAgc0dsb2JhbFF1ZXVlUHRy ID0gJnF1ZXVlOw0KKyNlbmRpZiAgICAgICAgDQogICAgICAgICBmb3IgKGF1dG8mIHRhc2sgOiBx dWV1ZSkgew0KICAgICAgICAgICAgIGF1dG8qIGdyb3VwID0gdGFzay0+Z3JvdXAoKTsNCiAgICAg ICAgICAgICBpZiAoIWdyb3VwIHx8IGdyb3VwLT5pc1N0b3BwZWRQZXJtYW5lbnRseSgpKQ0K