memory access out of bounds @ trace_processor_memory64.wasm

[Ahren-Li]

`UI: https://ui.perfetto.dev/v53.0-a3fe107e3

RuntimeError: memory access out of bounds @ trace_processor_memory64.wasm.perfetto::trace_processor::SliceMipmapOperator::Create(sqlite3*, void*, int, char const* const*, sqlite3_vtab**, char**)

• trace_processor_memory64.wasm.perfetto::trace_processor::SliceMipmapOperator::Create(sqlite3*, void*, int, char const* const*, sqlite3_vtab**, char**) (wasm://wasm/trace_processor_memory64.wasm-02ee9b3e:wasm-function[4542]:0x4b3979)
• trace_processor_memory64.wasm.vtabCallConstructor (wasm://wasm/trace_processor_memory64.wasm-02ee9b3e:wasm-function[488]:0x8f04f)
• trace_processor_memory64.wasm.sqlite3_step (wasm://wasm/trace_processor_memory64.wasm-02ee9b3e:wasm-function[361]:0x7087a)
• trace_processor_memory64.wasm.perfetto::trace_processor::SqliteEngine::PreparedStatement::Step() (wasm://wasm/trace_processor_memory64.wasm-02ee9b3e:wasm-function[3812]:0x3ee8d8)
• trace_processor_memory64.wasm.perfetto::trace_processor::PerfettoSqlEngine::ExecuteUntilLastStatement(perfetto::trace_processor::SqlSource) (wasm://wasm/trace_processor_memory64.wasm-02ee9b3e:wasm-function[3670]:0x3d8d3d)
• trace_processor_memory64.wasm.perfetto::trace_processor::TraceProcessorImpl::ExecuteQuery(std::__2::basic_string<char, std::__2::char_traits, std::__2::allocator> const&) (wasm://wasm/trace_processor_memory64.wasm-02ee9b3e:wasm-function[127]:0x33676)
• trace_processor_memory64.wasm.trace_processor_on_rpc_request (wasm://wasm/trace_processor_memory64.wasm-02ee9b3e:wasm-function[306]:0x5da0b)
• (engine_bundle.js:1209:14)
• Object.ccall (engine_bundle.js:5282:15)
• WasmBridge.onMessage (engine_bundle.js:10937:34)
• (stderr: )
• (warning: unsupported syscall: __syscall_mprotect)
• (warning: unsupported syscall: __syscall_mprotect)
• (warning: unsupported syscall: __syscall_mprotect)
• (warning: unsupported syscall: __syscall_mprotect)
• (warning: unsupported syscall: __syscall_mprotect)
• (warning: unsupported syscall: __syscall_mprotect)
• Loading trace 67.11 MB (194.5 MB/s)Loading trace 134.22 MB (213.4 MB/s)Loading trace 201.33 MB (221.5 MB/s)Loading trace 268.44 MB (222.4 MB/s)Loading trace 335.54 MB (225.0 MB/s)Loading trace 402.65 MB (226.7 MB/s)Loading trace 469.76 MB (229.3 MB/s)Loading trace 536.87 MB (229.6 MB/s)Loading trace 603.98 MB (230.7 MB/s)Loading trace 671.09 MB (232.7 MB/s)Loading trace 681.28 MB (23.6 MB/s)

Trace: not available (ARRAY_BUFFER). Provide repro steps.
UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Referrer: `

[Ahren-Li]

used -g -O0 build，An issue has been identified in the conversion of int64_t(-1) to uint32_t(0xffffffff)

_mipmap_operator.cc:118 depth is 0xffffffff state->by_depth.size() is 4 ../../buildtools/libcxx/include/vector:1411: assertion __n < size() failed: vector[] index out of bounds Program received signal SIGABRT, Aborted.

because "(uint32_t)0xffffffff + 1 = 0"

Therefore, the by_depth to be resized to 0.
Finally, coredump is triggered(memory access out of bounds).

[Ahren-Li]

Ahren-Li#1 pls check