186641 2018-06-14 19:18:08 -0700 wasm marshalArgument unanble to correcly handle type B3:void 2018-08-08 20:04:25 -0700 1 1 1 Unclassified WebKit WebAssembly WebKit Local Build All All RESOLVED FIXED InRadar P2 Normal --- 1 dwfault webkit-unassigned fpizlo keith_miller webkit-bug-importer oldest_to_newest 1433218 0 342784 dwfault 2018-06-14 19:18:08 -0700 Created attachment 342784 The sample would make jsc crash. marshalArugument in WebAssembly of JavaScriptCore could not correcly handle type B3::void as argument function signature. Tested on git commit The byte 0x70 in section Type was added up to 0xf0, in: template<typename SuccessType> ALWAYS_INLINE bool Parser<SuccessType>::parseInt7(int8_t& result) { if (m_offset >= length()) return false; uint8_t v = source()[m_offset++]; result = (v & 0x40) ? WTF::bitwise_cast<int8_t>(uint8_t(v | 0x80)) : v; return (v & 0x80) == 0; } template<typename Functor> void loadArguments(const Signature& signature, B3::Procedure& proc, B3::BasicBlock* block, B3::Origin origin, const Functor& functor) const { B3::Value* framePointer = block->appendNew<B3::Value>(proc, B3::FramePointer, origin); size_t gpArgumentCount = 0; size_t fpArgumentCount = 0; size_t stackOffset = headerSize; for (size_t i = 0; i < signature.argumentCount(); ++i) { B3::Type type = toB3Type(signature.argument(i)); ---> In the function "toB3Type" byte 0xf0 is passed in, and B3::Void is returned. B3::Value* argument; B3::ValueRep rep = marshallArgument(type, gpArgumentCount, fpArgumentCount, stackOffset); ---> In this function "marshallArgument", B3::Void cannot be handled correcly, which caused a crash. if (rep.isReg()) { argument = block->appendNew<B3::ArgumentRegValue>(proc, origin, rep.reg()); if (type == B3::Int32 || type == B3::Float) argument = block->appendNew<B3::Value>(proc, B3::Trunc, origin, argument); } else { ASSERT(rep.isStackArgument()); B3::Value* address = block->appendNew<B3::Value>(proc, B3::Add, origin, framePointer, block->appendNew<B3::Const64Value>(proc, origin, rep.offsetFromSP())); argument = block->appendNew<B3::MemoryValue>(proc, B3::Load, type, origin, address); } functor(argument, i); } } The crash happened here: B3::ValueRep marshallArgument(B3::Type type, size_t& gpArgumentCount, size_t& fpArgumentCount, size_t& stackOffset) const { switch (type) { case B3::Int32: case B3::Int64: return marshallArgumentImpl(m_gprArgs, type, gpArgumentCount, stackOffset); case B3::Float: case B3::Double: return marshallArgumentImpl(m_fprArgs, type, fpArgumentCount, stackOffset); case B3::Void: break; } RELEASE_ASSERT_NOT_REACHED(); --->crash. } 1433219 1 dwfault 2018-06-14 19:19:16 -0700 Tested on git commit 57ff755 1448913 2 keith_miller 2018-08-08 20:03:31 -0700 I think this was fixed by: http://trac.webkit.org/r232970. 1448914 3 webkit-bug-importer 2018-08-08 20:04:25 -0700 <rdar://problem/43076679> 342784 2018-06-14 19:18:08 -0700 2018-06-14 19:18:08 -0700 The sample would make jsc crash. PoC.js application/x-javascript 511 dwfault dmFyIHdhc21Nb2R1bGUgPSBuZXcgV2ViQXNzZW1ibHkuTW9kdWxlKG5ldyBVaW50OEFycmF5KFsw eDAsMHg2MSwweDczLDB4NmQsMHgxLDB4MCwweDAsMHgwLDB4MSwweGYsMHgxLDB4NjAsMHhhLDB4 NzAsMHg3YywweDdjLDB4N2MsMHg3YywweDdjLDB4N2MsMHg3YywweDdjLDB4N2MsMHgxLDB4N2Ms MHgzLDB4MiwweDEsMHgwLDB4YSwweDMxLDB4MSwweDJmLDB4MCwweDIwLDB4MCwweDIwLDB4MSww eDIwLDB4MiwweDIwLDB4MywweDIwLDB4MiwweDIwLDB4MywweDIwLDB4NCwweDIwLDB4NSwweDIw LDB4NiwweDAsMHgwLDB4MCwweDAsMHgyMCwweDksMHgxMCwweDAsMHgwLDB4MTAsMHgwLDB4Yiww eDAsMHhlLDB4NCwweDZlLDB4NjEsMHg2ZCwweDY0LDB4MSwweDcsMHgxLDB4MSwweDQsMHg2ZCww eDI3LDB4NjksMHg2ZSxdKSk7CnZhciB3YXNtSW5zdGFuY2UgPSBuZXcgV2ViQXNzZW1ibHkuSW5z dGFuY2Uod2FzbU1vZHVsZSk7CnByaW50KHdhc21JbnN0YW5jZS5leHBvcnRzLm1haW4oKSk7Cg==