249378 2022-12-15 00:45:39 -0800 [JSC] Tuple should be able to include V128 constant 2022-12-16 21:34:13 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Critical --- 1 cz18811105578 ysuzuki bfulgham webkit-bug-importer ysuzuki oldest_to_newest 1919488 0 464055 cz18811105578 2022-12-15 00:45:39 -0800 Created attachment 464055 Reproducible poc this poc can reproduce the crash stably commit: bcd8cc0c0c83b0f2ddb78977a843650168bb138f Stack #0 0x00007ffff5ad400b in raise () from /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007ffff5ab3859 in abort () from /lib/x86_64-linux-gnu/libc.so.6 #2 0x0000555555a3a1da in WTFCrashWithInfo(int, char const*, char const*, int) () #3 0x0000555556a13a79 in JSC::Wasm::AirIRGenerator64::emitMaterializeConstant(JSC::B3::Air::BasicBlock*, JSC::Wasm::Type, unsigned long, JSC::Wasm::TypedTmp&) () #4 0x0000555556a48b0d in JSC::Wasm::AirIRGeneratorBase<JSC::Wasm::AirIRGenerator64, JSC::Wasm::TypedTmp>::addEndToUnreachable(JSC::Wasm::FunctionParserTypes<JSC::Wasm::AirIRGeneratorBase<JSC::Wasm::AirIRGenerator64, JSC::Wasm::TypedTmp>::ControlData, JSC::Wasm::TypedTmp>::ControlEntry&, WTF::Vector<JSC::Wasm::FunctionParserTypes<JSC::Wasm::AirIRGeneratorBase<JSC::Wasm::AirIRGenerator64, JSC::Wasm::TypedTmp>::ControlData, JSC::Wasm::TypedTmp>::TypedExpression, 16ul, WTF::UnsafeVectorOverflow, 16ul, WTF::FastMalloc> const&) () #5 0x0000555556a2dfa6 in JSC::Wasm::FunctionParser<JSC::Wasm::AirIRGenerator64>::parseUnreachableExpression() () #6 0x0000555556a2d5c1 in JSC::Wasm::FunctionParser<JSC::Wasm::AirIRGenerator64>::parseBody() () #7 0x0000555556a2c65f in JSC::Wasm::FunctionParser<JSC::Wasm::AirIRGenerator64>::parse() () #8 0x0000555556a23eae in std::experimental::fundamentals_v3::expected<std::unique_ptr<JSC::Wasm::InternalFunction, std::default_delete<JSC::Wasm::InternalFunction> >, WTF::String> JSC::Wasm::parseAndCompileAirImpl<JSC::Wasm::AirIRGenerator64>(JSC::Wasm::CompilationContext&, JSC::Wasm::FunctionData const&, JSC::Wasm::TypeDefinition const&, WTF::Vector<JSC::Wasm::UnlinkedWasmToWasmCall, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, JSC::Wasm::ModuleInformation const&, JSC::MemoryMode, unsigned int, std::optional<bool>, JSC::Wasm::TierUpCount*) () #9 0x0000555556a1c5d1 in JSC::Wasm::parseAndCompileAir(JSC::Wasm::CompilationContext&, JSC::Wasm::FunctionData const&, JSC::Wasm::TypeDefinition const&, WTF::Vector<JSC::Wasm::UnlinkedWasmToWasmCall, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, JSC::Wasm::ModuleInformation const&, JSC::MemoryMode, unsigned int, std::optional<bool>, JSC::Wasm::TierUpCount*) () #10 0x00005555569c7e76 in JSC::Wasm::BBQPlan::compileFunction(unsigned int, JSC::Wasm::CompilationContext&, WTF::Vector<JSC::Wasm::UnlinkedWasmToWasmCall, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, JSC::Wasm::TierUpCount*) () #11 0x00005555569c6a56 in JSC::Wasm::BBQPlan::work(JSC::Wasm::Plan::CompilationEffort) () #12 0x0000555556b49ab2 in JSC::Wasm::Worklist::Thread::work() () #13 0x0000555556bf4143 in WTF::Detail::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0, void>::call() () #14 0x0000555556c1537f in WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) () #15 0x0000555556c6f096 in WTF::wtfThreadEntryPoint(void*) () #16 0x00007ffff5fe3609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0 #17 0x00007ffff5bb0133 in clone () from /lib/x86_64-linux-gnu/libc.so.6 1919489 1 webkit-bug-importer 2022-12-15 00:45:51 -0800 <rdar://problem/103392110> 1919812 2 cz18811105578 2022-12-15 22:04:14 -0800 with --useWebAssemblySIMD=true flag 1920043 3 ysuzuki 2022-12-16 13:01:40 -0800 Changing the component from security to normal since this is not shipped. This is WIP developing feature. 1920056 4 ysuzuki 2022-12-16 14:03:03 -0800 Pull request: https://github.com/WebKit/WebKit/pull/7779 1920185 5 ews-feeder 2022-12-16 21:34:10 -0800 Committed 258034@main (c19143329472): <https://commits.webkit.org/258034@main> Reviewed commits have been landed. Closing PR #7779 and removing active labels. 464055 2022-12-15 00:45:39 -0800 2022-12-15 00:45:39 -0800 Reproducible poc poc1215-2.js text/javascript 1060 cz18811105578 dmFyIHdhc21fY29kZSA9IG5ldyBVaW50OEFycmF5KFswLDk3LDExNSwxMDksMSwwLDAsMCwxLDIw MywxMjgsMTI4LDEyOCwwLDcsOTYsMywxMjcsMTI3LDEyNywxLDEyNyw5NiwxLDEyMywwLDk2LDEs MTI2LDE1LDEyNSwxMjYsMTI1LDEyNywxMjMsMTI1LDEyNywxMjYsMTI0LDEyNSwxMjcsMTI3LDEy NywxMjYsMTI3LDk2LDEsMTI2LDEsMTI2LDk2LDEsMTI2LDgsMTI3LDEyMywxMjUsMTI3LDEyNiwx MjQsMTI1LDEyNyw5NiwxLDEyNiw0LDEyNywxMjcsMTI2LDEyNyw5NiwxNSwxMjUsMTI2LDEyNSwx MjcsMTIzLDEyNSwxMjcsMTI2LDEyNCwxMjUsMTI3LDEyNywxMjcsMTI2LDEyNywxLDEyNywzLDEz MCwxMjgsMTI4LDEyOCwwLDEsMCw0LDEzMywxMjgsMTI4LDEyOCwwLDEsMTEyLDEsMSwxLDUsMTMy LDEyOCwxMjgsMTI4LDAsMSwxLDE2LDMyLDEzLDEzMSwxMjgsMTI4LDEyOCwwLDEsMCwxLDcsMTM2 LDEyOCwxMjgsMTI4LDAsMSw0LDEwOSw5NywxMDUsMTEwLDAsMCw5LDEzOSwxMjgsMTI4LDEyOCww LDEsNiwwLDY1LDAsMTEsMTEyLDEsMjEwLDAsMTEsMTAsMjU0LDEyOCwxMjgsMTI4LDAsMSwxMjQs MSwxLDEyNiw2NiwxMjksMTM0LDIsMywyLDE4MCw2NiwwLDIsMywxLDExLDY3LDEyNywwLDAsMCw2 NiwwLDIsMywxLDExLDIsNCwxNjcsNjUsMCwyNTMsMTUsNjcsMCwwLDAsMCw2NSwwLDY2LDAsNjgs MCwwLDAsMCwwLDAsMCwwLDY3LDAsMCwwLDAsNjUsMCwxMSwzMiwzLDY1LDAsNjUsMCwxMTksNjUs MjIzLDEsMTE5LDY1LDE2OSwxLDEwNCwxMDUsMTA0LDY1LDAsMjUzLDE1LDgsMCw2OSw2OSwxMTks NCw1LDE2Nyw2NSwwLDY2LDAsNjUsMCw1LDE2Nyw2NSwwLDY2LDAsNjUsMCwxMSwxMSwyLDYsMjYs MjYsMjYsMjYsMjYsMjYsMjYsMjYsMjYsMjYsMjYsMjYsMjYsMjYsMTY4LDExLDExXSk7CnZhciB3 YXNtX21vZHVsZSA9IG5ldyBXZWJBc3NlbWJseS5Nb2R1bGUod2FzbV9jb2RlKTsKdmFyIHdhc21f aW5zdGFuY2UgPSBuZXcgV2ViQXNzZW1ibHkuSW5zdGFuY2Uod2FzbV9tb2R1bGUpOwp2YXIgZiA9 IHdhc21faW5zdGFuY2UuZXhwb3J0cy5tYWluOwpmKCk7Cg==