Issue metadata
Sign in to add a comment
|
this wasm example crashes chrome
Reported by
billco...@gmail.com,
Jan 15
|
||||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36 Steps to reproduce the problem: https://tbfleming.github.io/cib/ go to the above page, click compile from the bottom left panel and then run from the bottom right panel. This will crash chrome. it used to work for chrome < 69 What is the expected behavior? the demo shouldn't crash the browser What went wrong? the demo crashes the browser Did this work before? Yes 68 Chrome version: 70.0.3538.77 Channel: stable OS Version: ubuntu 17.10 Flash Version:
,
Jan 16
Thanks for filing the issue! Unable to reproduce the issue on reported chrome version 70.0.3538.77 and on the latest stable 71.0.3578.98 using Ubuntu 17.10 with the below mentioned steps. 1. Launched Chrome 2. Navigated to https://tbfleming.github.io/cib/ 3. Clicked compile from the bottom left panel and then clicked run from the bottom right panel. In the process we didn't observe any crash. Attaching the screenshots of the same for reference. @Reporter: Could you please let us know if we have missed anything in the process. Requesting you to check the same in a new profile without any apps & extensions and let us know if the issue still persists.
,
Jan 17
(5 days ago)
attach my screenshot, even you didn't reproduce the crash, the memory access out of bound issue is also a regression, didn't see it with < 69 but I'm not sure whose fault that is.
,
Jan 17
(5 days ago)
Thank you for providing more feedback. Adding the requester to the cc list. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jan 17
(5 days ago)
the c++ code itself looks legit. but when it is compiled into wasm, it caused the out of bound error. interestingly, people saw the out of bound issue with newer firefox too, so the issue could be the wasm/clang toolchain. but I didn't seem to see any recent updates to the toolchain used in that project. and this code works fine with my older firefox:
,
Jan 17
(5 days ago)
Bisected in Windows 7 to r566745 "Update V8" https://chromium.googlesource.com/v8/v8/+log/3f7f40e7..a0f86882 There are two wasm-related changes: 7ce76fbc340e61dc0021ef497bf6bb6cecda20e0 [wasm] Enable mutable-global by default da03262e4c0fb58af1d25c4336506f2477bfd188 [wasm] Fix for exporting imported mutable globals Landed in 69.0.3460.0
,
Jan 18
(4 days ago)
Thanks @woxxom... Somehow couldn't reproduce the issue on Windows 7 too from our end, as per comment#6....assigning it to "Ben Smith" from https://chromium.googlesource.com/v8/v8/+log/3f7f40e7..a0f86882 Note: From C#6 adding OS Windows. @Ben Smith: Please help in re-assigning it to the right owner if this isn't related to your change.
,
Jan 18
(4 days ago)
I get a runtime error: memory access out of bounds, i.e. it does not crash the browser. It is likely that enabling mutable globals exercises a different path in the generated Emscripten code, and thus is likely a toolchain issue. Messing with the demo, if I comment out the constructor of the "struct S", it no longer crashes. So maybe cout does not work before main can be called. Maybe Alon can help.
,
Jan 18
(4 days ago)
@billconan - what happens when the user presses "Run"? I am guessing it has some custom JS to load the compiled wasm, which is not emitted by emscripten, since you just run clang in the browser in this demo (and not the rest of the emscripten compiler)? If so, then perhaps the issue is how that code handles exported globals. This was a breaking change in wasm, see e.g. how emscripten handles it here: https://github.com/emscripten-core/emscripten/blob/incoming/src/support.js#L479 if (typeof value === 'object') { // a breaking change in the wasm spec, globals are now objects // https://github.com/WebAssembly/mutable-global/issues/1 value = value.value; } (see also the discussion in that quoted link to the mutable-global project) If your custom JS doesn't handle exported globals in the new way, it may get an export from the wasm and get a zero instead of the actual value, so it might then end up calling the wrong code or something else later. However, reading https://github.com/tbfleming/cib/blob/master/src/process-runtime.js (is that the right place?) I don't see it depend on exported globals, but maybe I'm missing something? |
|||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||
Comment 1 by tkent@chromium.org
, Jan 16Labels: Needs-Bisect