eb131dcc7b
The function {memory_copy_wrapper} is called directly from WebAssembly.
Before calling {memory_copy_wrapper} we do not reset the
tread-in-wasm flag. On asan builds on Windows this causes the problem
observed in the crash report.
My theory is the following: asan on Windows uses exceptions to allocate
shadow memory lazily. When {memory_copy_wrapper} accesses memory, asan
causes an exception to allocate shadow memory. This exception is first
caught by the WebAssembly trap handler, which resets the
thread-in-wasm flag but then does not handle the exception because it
cannot find a proper landing pad. Asan then handles the exception and
continues execution. However. the thread-in-wasm flag is not set
anymore. A later check of the thread-in-wasm flag then fails.
This CL disables asan for {memory_copy_wrapper} and thereby fixes the
problem. As indicated above, another solution would be to reset and set
the thread-in-wasm flag before and after the call to the C function,
respectively. However, we do not do that for other uses of direct calls
to C.
R=binji@chromium.org
Bug: chromium:952342
Change-Id: I2adb2eccf2ac25be58392d21f8f43a04414c7811
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1584326
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61040}
19 lines
721 B
JavaScript
19 lines
721 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
load('test/mjsunit/wasm/wasm-module-builder.js');
|
|
|
|
const memory = new WebAssembly.Memory({initial: 1});
|
|
|
|
let builder = new WasmModuleBuilder();
|
|
builder.addImportedMemory("imports", "mem", 1);
|
|
builder.addFunction("copy", kSig_v_iii)
|
|
.addBody([kExprGetLocal, 0, // dst
|
|
kExprGetLocal, 1, // src
|
|
kExprGetLocal, 2, // size
|
|
kNumericPrefix, kExprMemoryCopy, 0, 0]).exportAs("copy");
|
|
let instance = builder.instantiate({imports: {mem: memory}});
|
|
memory.grow(1);
|
|
instance.exports.copy(0, kPageSize, 11);
|