Bug 263444
| Summary: | [JSC] Wasm extended constant generator crashes in debug builds | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Joseph Griego <joseph.j.griego> |
| Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Joseph Griego
For example, in the test wasm.yaml/wasm/gc/table_init.js.default-wasm:
ERROR: Unchecked JS exception:
This scope can throw a JS exception: tryCreate @ /home/jgriego/proj/WebKit3/Source/JavaScriptCore/wasm/js/JSWebAssemblyStruct.cpp:56
(ExceptionScope::m_recursionDepth was 9)
But the exception was unchecked as of this scope: evaluateConstantExpression @ /home/jgriego/proj/WebKit3/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp:751
(ExceptionScope::m_recursionDepth was 8)
Unchecked exception detected at:
1 0x7ffff539e92a /home/jgriego/proj/WebKit3/WebKitBuild/Debug/lib/libJavaScriptCore.so.1(+0x1f9e92a) [0x7ffff539e92a]
2 0x7ffff5387e85 JSC::ThrowScope::~ThrowScope()
3 0x7ffff58be882 /home/jgriego/proj/WebKit3/WebKitBuild/Debug/lib/libJavaScriptCore.so.1(+0x24be882) [0x7ffff58be882]
4 0x7ffff58bc5df /home/jgriego/proj/WebKit3/WebKitBuild/Debug/lib/libJavaScriptCore.so.1(+0x24bc5df) [0x7ffff58bc5df]
5 0x7ffff588a099 /home/jgriego/proj/WebKit3/WebKitBuild/Debug/lib/libJavaScriptCore.so.1(+0x248a099) [0x7ffff588a099]
6 0x7ffff58afd35 /home/jgriego/proj/WebKit3/WebKitBuild/Debug/lib/libJavaScriptCore.so.1(+0x24afd35) [0x7ffff58afd35]
7 0x7fffa60000c7 [0x7fffa60000c7]
ASSERTION FAILED: !m_needExceptionCheck
/home/jgriego/proj/WebKit3/Source/JavaScriptCore/runtime/VM.cpp(1409) : void JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation&)
Thread 1 "jsc" received signal SIGABRT, Aborted.
__pthread_kill_implementation (no_tid=0, signo=6, threadid=140737352566592) at ./nptl/pthread_kill.c:44
44 ./nptl/pthread_kill.c: No such file or directory.
(gdb) bt
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140737352566592) at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=140737352566592) at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=140737352566592, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3 0x00007ffff2c42476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4 0x00007ffff2c287f3 in __GI_abort () at ./stdlib/abort.c:79
#5 0x00007ffff35ed130 in WTFCrashWithInfo () at /home/jgriego/proj/WebKit3/WebKitBuild/Debug/WTF/Headers/wtf/Assertions.h:778
#6 0x00007ffff539ea94 in JSC::VM::verifyExceptionCheckNeedIsSatisfied (this=0x7fffa4000000, recursionDepth=8, location=...) at /home/jgriego/proj/WebKit3/Source/JavaScriptCore/runtime/VM.cpp:1409
#7 0x00007ffff5387e85 in JSC::ThrowScope::~ThrowScope (this=0x7fffffffc440, __in_chrg=<optimized out>) at /home/jgriego/proj/WebKit3/Source/JavaScriptCore/runtime/ThrowScope.cpp:49
#8 0x00007ffff58be882 in JSC::WebAssemblyModuleRecord::evaluateConstantExpression (this=0x7fffe631d1a8, globalObject=0x7fffa441a068, constantExpression=..., info=..., expectedType=..., result=@0x7fffffffc4f8: 140737062426408)
at /home/jgriego/proj/WebKit3/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp:759
#9 0x00007ffff58bc5df in JSC::WebAssemblyModuleRecord::initializeExports (this=0x7fffe631d1a8, globalObject=0x7fffa441a068) at /home/jgriego/proj/WebKit3/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp:546
#10 0x00007ffff588a099 in JSC::JSWebAssemblyInstance::finalizeCreation (this=0x7fffe62f2528, vm=..., globalObject=0x7fffa441a068, wasmCalleeGroup=..., creationMode=JSC::Wasm::CreationMode::FromJS)
at /home/jgriego/proj/WebKit3/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp:147
#11 0x00007ffff58afd35 in JSC::constructJSWebAssemblyInstance (globalObject=0x7fffa441a068, callFrame=0x7fffffffc8b0) at /home/jgriego/proj/WebKit3/Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.cpp:78
#12 0x00007fffa60000c7 in ?? ()
#13 0x00007fffffffc940 in ?? ()
#14 0x00007ffff35a6644 in js_trampoline_op_construct () at /home/jgriego/proj/WebKit3/Source/JavaScriptCore/llint/LowLevelInterpreter.asm:1195
#15 0x0000000000000000 in ?? ()
(gdb)
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Joseph Griego
Pull request: https://github.com/WebKit/WebKit/pull/19342
EWS
Committed 269718@main (a6a933a795b3): <https://commits.webkit.org/269718@main>
Reviewed commits have been landed. Closing PR #19342 and removing active labels.
Radar WebKit Bug Importer
<rdar://problem/117418773>