New issue
Advanced search Search tips

Issue 822039 link

Starred by 2 users

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug



Sign in to add a comment

Ah Snap error when allocating webassembly memory

Reported by joe.fisc...@googlemail.com, Mar 14 2018

Issue description

UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.162 Safari/537.36

Steps to reproduce the problem:
1. Load a simple html file in Chrome:
<html>
<body>
<div id="output"></div>
<script>
var wasmMemory = new WebAssembly.Memory({ initial:32000, minimum:2048});
document.querySelector('#output').innerHTML = "memory allocated: "+wasmMemory.buffer.byteLength;
</script>
</body>
</html>

2. Press F5 to refresh the page.

What is the expected behavior?
The memory is either succesfully allocated, or an exception is thrown and visible in the Console.

What went wrong?
The Tab crashes with Ah Snap on every second refresh of the Page. The GC doesnt collect the webassembly memory on pressing F5, so that the reloaded page cannot allocate the memory AND does not throw an exception.

Did this work before? N/A 

Chrome version: 65.0.3325.162  Channel: stable
OS Version: 10.0
Flash Version: 

Works on Firefox.
 

Comment 1 by woxxom@gmail.com, Mar 14 2018

According to my bisect the bug evolved twice and is still present in Canary:

1. r528223 V8-roll broke the ability to allocate 2GB in WASM,
   suspecting ae45cc1f5c7dc3b3ecd36cee0cc1ec8980d36e94
   "[wasm] Pad all WASM memories to the next power of 2 size"
   Landed in 65.0.3318.0

2. r530635 restored the ability to allocate 2GB in WASM, but the resultant behavior is buggy as described in this report.
   60d13f8af042bebb93f25ebc6e81a703a57bf9d4 = https://crrev.com/c/876484 by bbudge@chromium.org
   "Reland [partition_alloc] Allow 2 GiB direct mapped allocations."
   Landed in 66.0.3326.0
   Merged to 65.0.3325.13
   Merged to 64.0.3282.112

Labels: Needs-Triage-M65

Comment 3 by kochi@chromium.org, Mar 15 2018

Related: history of this bug's context:  issue 820795 
Components: -Blink Blink>JavaScript>WebAssembly
Owner: titzer@chromium.org
Status: Assigned (was: Unconfirmed)

Sign in to add a comment