New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 922207 link

Starred by 1 user

Issue metadata

Status: Assigned
Owner:
Last visit 18 days ago
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows
Pri: 1
Type: Bug-Regression



Sign in to add a comment

this wasm example crashes chrome

Reported by billco...@gmail.com, Jan 15

Issue description

UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36

Steps to reproduce the problem:
https://tbfleming.github.io/cib/

go to the above page, click compile from the bottom left panel and then run from the bottom right panel. This will crash chrome.

it used to work for chrome < 69

What is the expected behavior?
the demo shouldn't crash the browser 

What went wrong?
the demo crashes the browser

Did this work before? Yes 68

Chrome version: 70.0.3538.77  Channel: stable
OS Version: ubuntu 17.10
Flash Version:
 
Components: -Blink Blink>JavaScript
Labels: Needs-Bisect
Cc: vamshi.kommuri@chromium.org
Labels: Triaged-ET Needs-Milestone Needs-Feedback
Thanks for filing the issue!

Unable to reproduce the issue on reported chrome version 70.0.3538.77 and on the latest stable 71.0.3578.98 using Ubuntu 17.10 with the below mentioned steps.
1. Launched Chrome
2. Navigated to https://tbfleming.github.io/cib/
3. Clicked compile from the bottom left panel and then clicked run from the bottom right panel.
In the process we didn't observe any crash. Attaching the screenshots of the same for reference.

@Reporter: Could you please let us know if we have missed anything in the process. Requesting you to check the same in a new profile without any apps & extensions and let us know if the issue still persists.
922207_M71.png
167 KB View Download
922207_M70.png
158 KB View Download

Comment 3 by billco...@gmail.com, Jan 17 (5 days ago)

attach my screenshot,

even you didn't reproduce the crash,

the memory access out of bound issue is also a regression, didn't see it with < 69

but I'm not sure whose fault that is. 
Selection_033.png
105 KB View Download
Selection_034.png
23.6 KB View Download
Selection_035.png
14.5 KB View Download
Project Member

Comment 4 by sheriffbot@chromium.org, Jan 17 (5 days ago)

Labels: -Needs-Feedback
Thank you for providing more feedback. Adding the requester to the cc list.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 5 by billco...@gmail.com, Jan 17 (5 days ago)

the c++ code itself looks legit. but when it is compiled into wasm, it caused the out of bound error.

interestingly, people saw the out of bound issue with newer firefox too, so the issue could be the wasm/clang toolchain.

but I didn't seem to see any recent updates to the toolchain used in that project.

and this code works fine with my older firefox:

Selection_036.png
108 KB View Download

Comment 6 by woxxom@gmail.com, Jan 17 (5 days ago)

Bisected in Windows 7 to r566745 "Update V8"
https://chromium.googlesource.com/v8/v8/+log/3f7f40e7..a0f86882

There are two wasm-related changes:
7ce76fbc340e61dc0021ef497bf6bb6cecda20e0 [wasm] Enable mutable-global by default
da03262e4c0fb58af1d25c4336506f2477bfd188 [wasm] Fix for exporting imported mutable globals

Landed in 69.0.3460.0

Comment 7 by vamshi.kommuri@chromium.org, Jan 18 (4 days ago)

Components: -Blink>JavaScript Blink>JavaScript>WebAssembly
Labels: -Pri-2 -Needs-Bisect RegressedIn-69 Target-71 Target-72 Target-73 M-73 FoundIn-71 FoundIn-73 FoundIn-72 hasbisect OS-Windows Pri-1
Owner: binji@chromium.org
Status: Assigned (was: Unconfirmed)
Thanks @woxxom...

Somehow couldn't reproduce the issue on Windows 7 too from our end, as per comment#6....assigning it to "Ben Smith" from https://chromium.googlesource.com/v8/v8/+log/3f7f40e7..a0f86882
Note: From C#6 adding OS Windows.

@Ben Smith: Please help in re-assigning it to the right owner if this isn't related to your change.

Comment 8 by titzer@chromium.org, Jan 18 (4 days ago)

Owner: azakai@chromium.org
I get a runtime error: memory access out of bounds, i.e. it does not crash the browser. It is likely that enabling mutable globals exercises a different path in the generated Emscripten code, and thus is likely a toolchain issue. Messing with the demo, if I comment out the constructor of the "struct S", it no longer crashes. So maybe cout does not work before main can be called.

Maybe Alon can help.

Comment 9 by azakai@google.com, Jan 18 (4 days ago)

@billconan - what happens when the user presses "Run"? I am guessing it has some custom JS to load the compiled wasm, which is not emitted by emscripten, since you just run clang in the browser in this demo (and not the rest of the emscripten compiler)?

If so, then perhaps the issue is how that code handles exported globals. This was a breaking change in wasm, see e.g. how emscripten handles it here:

https://github.com/emscripten-core/emscripten/blob/incoming/src/support.js#L479

  if (typeof value === 'object') {
    // a breaking change in the wasm spec, globals are now objects
    // https://github.com/WebAssembly/mutable-global/issues/1
    value = value.value;
  }

(see also the discussion in that quoted link to the mutable-global project)

If your custom JS doesn't handle exported globals in the new way, it may get an export from the wasm and get a zero instead of the actual value, so it might then end up calling the wrong code or something else later.

However, reading

https://github.com/tbfleming/cib/blob/master/src/process-runtime.js

(is that the right place?) I don't see it depend on exported globals, but maybe I'm missing something?

Sign in to add a comment