260516 2023-08-22 05:29:21 -0700 [WASM] SEGV in JSC::Wasm::FunctionParser<JSC::Wasm::LLIntGenerator>::parseExpression 2023-12-14 10:10:17 -0800 1 1 1 Unclassified WebKit WebAssembly WebKit Local Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 247394 1 cz18811105578 asumu justin_michaud webkit-bug-importer oldest_to_newest 1972618 0 467386 cz18811105578 2023-08-22 05:29:21 -0700 Created attachment 467386 Reproducible poc Commit: 5466cd2c24514bdeee05075d5a2eb35e8c146e40 Run Flag: --useWebAssemblyTypedFunctionReferences=true --useWebAssemblyGC=true Backtrace: ``` #0 JSC::Wasm::FunctionParser<JSC::Wasm::LLIntGenerator>::parseExpression (this=this@entry=0x7fffa8a78348) at ../../Source/JavaScriptCore/wasm/WasmFunctionParser.h:2728 #1 0x0000555557f34f4b in JSC::Wasm::FunctionParser<JSC::Wasm::LLIntGenerator>::parseBody (this=this@entry=0x7fffa8a78348) at ../../Source/JavaScriptCore/wasm/WasmFunctionParser.h:366 #2 0x0000555557ecb64e in JSC::Wasm::FunctionParser<JSC::Wasm::LLIntGenerator>::parse (this=this@entry=0x7fffa8a78348) at ../../Source/JavaScriptCore/wasm/WasmFunctionParser.h:336 #3 0x0000555557ec9edf in JSC::Wasm::parseAndCompileBytecode (functionStart=0x7fffec00f480 "", functionLength=<optimized out>, signature=..., info=..., functionIndex=functionIndex@entry=0x0) at ../../Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp:580 #4 0x0000555557fff3ba in JSC::Wasm::LLIntPlan::compileFunction (this=0x7fffec05d200, functionIndex=0x0) at ../../Source/JavaScriptCore/wasm/WasmLLIntPlan.cpp:89 #5 0x0000555557eaebd6 in JSC::Wasm::EntryPlan::compileFunctions (this=0x7fffec05d200, effort=<optimized out>) at ../../Source/JavaScriptCore/wasm/WasmEntryPlan.cpp:218 #6 0x000055555809a50f in JSC::Wasm::Worklist::Thread::work (this=0x7fffec02e1b0) at ../../Source/JavaScriptCore/wasm/WasmWorklist.cpp:111 #7 0x00005555582308b0 in WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0::operator()() const (this=<optimized out>) at ../../Source/WTF/wtf/AutomaticThread.cpp:229 #8 WTF::Detail::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0, void>::call() (this=<optimized out>) at ../../Source/WTF/wtf/Function.h:53 #9 0x00005555582763a9 in WTF::Function<void ()>::operator()() const (this=<optimized out>) at ../../Source/WTF/wtf/Function.h:82 #10 WTF::Thread::entryPoint (newThreadContext=0x7fffec02ebb0) at ../../Source/WTF/wtf/Threading.cpp:250 #11 0x0000555558339543 in WTF::wtfThreadEntryPoint (context=0x5555587a53bc) at ../../Source/WTF/wtf/posix/ThreadingPOSIX.cpp:242 #12 0x00007ffff5fd8609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0 #13 0x00007ffff5ba5133 in clone () from /lib/x86_64-linux-gnu/libc.so.6 ``` Segment fault when visitng the field of object inlineSignature while it is NULL. 1974179 1 webkit-bug-importer 2023-08-29 05:30:13 -0700 <rdar://problem/114622205> 1999033 2 asumu 2023-12-12 10:48:18 -0800 Pull request: https://github.com/WebKit/WebKit/pull/21693 1999625 3 ews-feeder 2023-12-14 10:10:14 -0800 Committed 272049@main (06ddd6593c2d): <https://commits.webkit.org/272049@main> Reviewed commits have been landed. Closing PR #21693 and removing active labels. 467386 2023-08-22 05:29:21 -0700 2023-08-22 05:29:21 -0700 Reproducible poc poc1.js text/javascript 897 cz18811105578 dmFyIHdhc21fY29kZSA9IG5ldyBVaW50OEFycmF5KFswLDk3LDExNSwxMDksMSwwLDAsMCwxLDE4 MiwxMjgsMTI4LDEyOCwwLDEwLDgwLDAsOTUsMCw4MCwwLDk1LDAsODAsMCw5NSwwLDgwLDAsOTUs MCw4MCwwLDk0LDEyNywxLDgwLDAsOTQsMTI3LDEsODAsMCw5NiwzLDEyNywxMjcsMTI3LDEsMTI3 LDk2LDAsMCw4MCwwLDk2LDEsMTA4LDYsMSwxMTIsODAsMCw5NiwxLDExMiwxLDEyNywzLDEzMCwx MjgsMTI4LDEyOCwwLDEsNiw0LDEzMywxMjgsMTI4LDEyOCwwLDEsMTEyLDEsMSwxLDUsMTMyLDEy OCwxMjgsMTI4LDAsMSwxLDE2LDMyLDEzLDEzMSwxMjgsMTI4LDEyOCwwLDEsMCw3LDcsMTM2LDEy OCwxMjgsMTI4LDAsMSw0LDEwOSw5NywxMDUsMTEwLDAsMCw5LDEzOSwxMjgsMTI4LDEyOCwwLDEs NiwwLDY1LDAsMTEsMTEyLDEsMjEwLDAsMTEsMTAsMjE4LDEyOCwxMjgsMTI4LDAsMSw4OCwwLDY1 LDIxMiwxNDAsMjI4LDIwNCwyLDY1LDE5MywyMDksMjIyLDE4MCwxMjcsNjUsMjUwLDE1OSwyMTQs MTc2LDEyNiwxNiwwLDI2LDY1LDIxNiwyMDAsMTQ4LDIzOSwyLDY1LDI0MSwxNDYsMTYxLDE3Mywy LDY1LDIxMiwyMDEsMTcxLDIzMyw0LDE2LDAsMjYsMywxMDgsNiwyLDEyNyw2NSwxNDgsMTk2LDIx MiwyMzIsMSw2NSwxNDgsMjEyLDIzOCwyMzcsMTI2LDY1LDE4NywxMjcsMjcsMTEsMzcsMCwyNTEs NzMsNiwxMSwyLDgsMjYsMjEwLDAsMTEsMiw5LDI2LDY1LDIwMiwyNDYsMTk5LDI0NCw2LDExLDEx XSk7CnZhciB3YXNtX21vZHVsZSA9IG5ldyBXZWJBc3NlbWJseS5Nb2R1bGUod2FzbV9jb2RlKTsK dmFyIHdhc21faW5zdGFuY2UgPSBuZXcgV2ViQXNzZW1ibHkuSW5zdGFuY2Uod2FzbV9tb2R1bGUp Owp2YXIgZiA9IHdhc21faW5zdGFuY2UuZXhwb3J0cy5tYWluOwpmKCk7