runtime: corruption after wasm stack overflow RangeError #70829
Description
Open https://swtch.com/tmp/wasmbug/ in Chrome.
Open the developer console (right click on page, Inspect, then click the Console tab).
It should say "Go starting".
Now click Run.
You should see an "Uncaught RangeError: Maximum call stack size exceeded":
0133597e:0x6304a Uncaught RangeError: Maximum call stack size exceeded
at runtime.__mspan_.init (0133597e:0x6304a)
at runtime.__mheap_.initSpan (0133597e:0x612a5)
at runtime.__mheap_.allocSpan (0133597e:0x60bf7)
at runtime.__mheap_.alloc.func1 (0133597e:0x5f504)
at runtime.systemstack (0133597e:0xfe0bd)
at runtime.__mheap_.alloc (0133597e:0x5f361)
at runtime.__mcentral_.grow (0133597e:0x28d09)
at runtime.__mcentral_.cacheSpan (0133597e:0x28161)
at runtime.__mcache_.refill (0133597e:0x26ca7)
at runtime.__mcache_.nextFree (0133597e:0x1c94b)
I'm a little surprised that it shows this stack and not a stack inside user code if the stack is too big. Perhaps this is the "m" stack and it is not supposed to be overflowing?
I am not sure whether Go is expected to continue at this point, but it seems to still be running. Click Run again.
Now you should see a fatal error like this:
fatal error: bad sweepgen in refill
wasm_exec.js:22
runtime stack:
wasm_exec.js:22 runtime.throw({0x46795, 0x16})
wasm_exec.js:22 /Users/rsc/go/src/runtime/panic.go:1099 +0x3 fp=0x24eec8 sp=0x24eea0 pc=0x143d0003
wasm_exec.js:22 runtime.(*mcache).refill(0x250108, 0x5)
wasm_exec.js:22 /Users/rsc/go/src/runtime/mcache.go:158 +0x29 fp=0x24ef18 sp=0x24eec8 pc=0x10b50029
wasm_exec.js:22 runtime.(*mcache).nextFree(0x250108, 0x5)
wasm_exec.js:22 /Users/rsc/go/src/runtime/malloc.go:964 +0xa fp=0x24ef50 sp=0x24ef18 pc=0x1088000a
wasm_exec.js:22 runtime.mallocgcTiny(0x8, 0x19840, 0x1)
wasm_exec.js:22 /Users/rsc/go/src/runtime/malloc.go:1175 +0x48 fp=0x24efa8 sp=0x24ef50 pc=0x10890048
wasm_exec.js:22 runtime.mallocgc(0x8, 0x19840, 0x1)
wasm_exec.js:22 /Users/rsc/go/src/runtime/malloc.go:1053 +0x15 fp=0x24efe0 sp=0x24efa8 pc=0x141e0015
wasm_exec.js:22 runtime.newobject(0x19840)
wasm_exec.js:22 /Users/rsc/go/src/runtime/malloc.go:1714 +0x4 fp=0x24f008 sp=0x24efe0 pc=0x10920004
wasm_exec.js:22 syscall/js.makeValue(0x7ff8000100000014)
wasm_exec.js:22 /Users/rsc/go/src/syscall/js/js.go:51 +0x5 fp=0x24f038 sp=0x24f008 pc=0x166d0005
wasm_exec.js:22 syscall/js.Value.Get({{}, 0x7ff8000100000006, 0x0}, {0x442f4, 0xd})
wasm_exec.js:22 /Users/rsc/go/src/syscall/js/js.go:298 +0x9 fp=0x24f078 sp=0x24f038 pc=0x16740009
wasm_exec.js:22 syscall/js.handleEvent()
wasm_exec.js:22 /Users/rsc/go/src/syscall/js/func.go:90 +0x2 fp=0x24f158 sp=0x24f078 pc=0x166c0002
wasm_exec.js:22 runtime.handleEvent()
wasm_exec.js:22 /Users/rsc/go/src/runtime/lock_js.go:287 +0x16 fp=0x24f1c8 sp=0x24f158 pc=0x10820016
wasm_exec.js:22 runtime.(*mheap).initSpan(0x241860, 0x372078, 0x0, 0x5, 0x5e4000, 0x1)
wasm_exec.js:22 /Users/rsc/go/src/runtime/mheap.go:1393 +0x2 fp=0x24f208 sp=0x24f1c8 pc=0x117b0002
wasm_exec.js:22 runtime.(*mheap).allocSpan(0x241860, 0x1, 0x0, 0x5)
wasm_exec.js:22 /Users/rsc/go/src/runtime/mheap.go:1346 +0x8e fp=0x24f2d0 sp=0x24f208 pc=0x117a008e
wasm_exec.js:22 runtime.(*mheap).alloc.func1()
wasm_exec.js:22 /Users/rsc/go/src/runtime/mheap.go:970 +0xb fp=0x24f318 sp=0x24f2d0 pc=0x1175000b
wasm_exec.js:22 runtime.systemstack(0x24f328)
wasm_exec.js:22 /Users/rsc/go/src/runtime/asm_wasm.s:172 +0x3 fp=0x24f320 sp=0x24f318 pc=0x14760003
wasm_exec.js:22 runtime.mstart()
wasm_exec.js:22 /Users/rsc/go/src/runtime/asm_wasm.s:29 fp=0x24f328 sp=0x24f320 pc=0x14720000
As I said, it is unclear to me whether the bug is the original RangeError or that it can't continue after the RangeError.
To reproduce:
git clone https://github.com/rsc/tmp
cd tmp/wasmshell
go generate # builds main.wasm, copies wasm_exec.js into local directory
go run serve.go
open http://localhost:8001/