Bug 263444 - [JSC] Wasm extended constant generator crashes in debug builds
Summary: [JSC] Wasm extended constant generator crashes in debug builds
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2023-10-20 08:02 PDT by Joseph Griego
Modified: 2023-10-24 08:56 PDT (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Joseph Griego 2023-10-20 08:02:43 PDT
For example, in the test wasm.yaml/wasm/gc/table_init.js.default-wasm:

ERROR: Unchecked JS exception:                                                 
    This scope can throw a JS exception: tryCreate @ /home/jgriego/proj/WebKit3/Source/JavaScriptCore/wasm/js/JSWebAssemblyStruct.cpp:56                                                                                                                                                                                      
        (ExceptionScope::m_recursionDepth was 9)                               
    But the exception was unchecked as of this scope: evaluateConstantExpression @ /home/jgriego/proj/WebKit3/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp:751                                                                                                                                                   
        (ExceptionScope::m_recursionDepth was 8)                               

Unchecked exception detected at:                                               
    1   0x7ffff539e92a /home/jgriego/proj/WebKit3/WebKitBuild/Debug/lib/libJavaScriptCore.so.1(+0x1f9e92a) [0x7ffff539e92a]                                                                                                                                                                                                   
    2   0x7ffff5387e85 JSC::ThrowScope::~ThrowScope()                          
    3   0x7ffff58be882 /home/jgriego/proj/WebKit3/WebKitBuild/Debug/lib/libJavaScriptCore.so.1(+0x24be882) [0x7ffff58be882]                                                                                                                                                                                                   
    4   0x7ffff58bc5df /home/jgriego/proj/WebKit3/WebKitBuild/Debug/lib/libJavaScriptCore.so.1(+0x24bc5df) [0x7ffff58bc5df]                                                                                                                                                                                                   
    5   0x7ffff588a099 /home/jgriego/proj/WebKit3/WebKitBuild/Debug/lib/libJavaScriptCore.so.1(+0x248a099) [0x7ffff588a099]                                                                                                                                                                                                   
    6   0x7ffff58afd35 /home/jgriego/proj/WebKit3/WebKitBuild/Debug/lib/libJavaScriptCore.so.1(+0x24afd35) [0x7ffff58afd35]                                                                                                                                                                                                   
    7   0x7fffa60000c7 [0x7fffa60000c7]                                        

ASSERTION FAILED: !m_needExceptionCheck                                        
/home/jgriego/proj/WebKit3/Source/JavaScriptCore/runtime/VM.cpp(1409) : void JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation&)                                                                                                                                                         

Thread 1 "jsc" received signal SIGABRT, Aborted.                               
__pthread_kill_implementation (no_tid=0, signo=6, threadid=140737352566592) at ./nptl/pthread_kill.c:44                                                        
44      ./nptl/pthread_kill.c: No such file or directory.                      
(gdb) bt                                                                       
#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=140737352566592) at ./nptl/pthread_kill.c:44                                                    
#1  __pthread_kill_internal (signo=6, threadid=140737352566592) at ./nptl/pthread_kill.c:78                                                                    
#2  __GI___pthread_kill (threadid=140737352566592, signo=signo@entry=6) at ./nptl/pthread_kill.c:89                                                            
#3  0x00007ffff2c42476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26                                                                          
#4  0x00007ffff2c287f3 in __GI_abort () at ./stdlib/abort.c:79                                                                                                 
#5  0x00007ffff35ed130 in WTFCrashWithInfo () at /home/jgriego/proj/WebKit3/WebKitBuild/Debug/WTF/Headers/wtf/Assertions.h:778                                                                                                                                                                                                
#6  0x00007ffff539ea94 in JSC::VM::verifyExceptionCheckNeedIsSatisfied (this=0x7fffa4000000, recursionDepth=8, location=...) at /home/jgriego/proj/WebKit3/Source/JavaScriptCore/runtime/VM.cpp:1409                                                                                                                          
#7  0x00007ffff5387e85 in JSC::ThrowScope::~ThrowScope (this=0x7fffffffc440, __in_chrg=<optimized out>) at /home/jgriego/proj/WebKit3/Source/JavaScriptCore/runtime/ThrowScope.cpp:49                                                                                                                                         
#8  0x00007ffff58be882 in JSC::WebAssemblyModuleRecord::evaluateConstantExpression (this=0x7fffe631d1a8, globalObject=0x7fffa441a068, constantExpression=..., info=..., expectedType=..., result=@0x7fffffffc4f8: 140737062426408)                                                                                            
    at /home/jgriego/proj/WebKit3/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp:759                                                                
#9  0x00007ffff58bc5df in JSC::WebAssemblyModuleRecord::initializeExports (this=0x7fffe631d1a8, globalObject=0x7fffa441a068) at /home/jgriego/proj/WebKit3/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp:546                                                                                                      
#10 0x00007ffff588a099 in JSC::JSWebAssemblyInstance::finalizeCreation (this=0x7fffe62f2528, vm=..., globalObject=0x7fffa441a068, wasmCalleeGroup=..., creationMode=JSC::Wasm::CreationMode::FromJS)                                                                                                                          
    at /home/jgriego/proj/WebKit3/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp:147                                                                  
#11 0x00007ffff58afd35 in JSC::constructJSWebAssemblyInstance (globalObject=0x7fffa441a068, callFrame=0x7fffffffc8b0) at /home/jgriego/proj/WebKit3/Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.cpp:78                                                                                                       
#12 0x00007fffa60000c7 in ?? ()                                                
#13 0x00007fffffffc940 in ?? ()                                                
#14 0x00007ffff35a6644 in js_trampoline_op_construct () at /home/jgriego/proj/WebKit3/Source/JavaScriptCore/llint/LowLevelInterpreter.asm:1195                                                                                                                                                                                
#15 0x0000000000000000 in ?? ()                                                
(gdb)
Comment 1 Joseph Griego 2023-10-20 08:03:51 PDT
Pull request: https://github.com/WebKit/WebKit/pull/19342
Comment 2 EWS 2023-10-24 08:55:39 PDT
Committed 269718@main (a6a933a795b3): <https://commits.webkit.org/269718@main>

Reviewed commits have been landed. Closing PR #19342 and removing active labels.
Comment 3 Radar WebKit Bug Importer 2023-10-24 08:56:15 PDT
<rdar://problem/117418773>