285505 2025-01-07 02:33:10 -0800 Incorrect Index Validation in grow_memory Instruction 2025-01-30 22:20:39 -0800 1 1 1 Unclassified WebKit WebAssembly Other Unspecified Unspecified RESOLVED INVALID InRadar P2 Normal --- 277743 1 tombox1337 webkit-unassigned d_degazio keith_miller mark.lam webkit-bug-importer ysuzuki oldest_to_newest 2085368 0 473821 tombox1337 2025-01-07 02:33:10 -0800 Created attachment 473821 program.js ### Description WebKit does not correctly enforce validation for the `grow_memory` instruction in WebAssembly modules. ### Environment - OS: Ubuntu 20.04 - CPU: amd64 - WebKit Version: 146fa28a329d220785d2972c1d691555141e6406 - Commands: ```bash ./JSCOnly/Debug/bin/jsc ./program.js ``` ### Test Case program.js ### Current State ```plaintext ./JSCOnly/Debug/bin/jsc ./program.js Exception: CompileError: WebAssembly.Module doesn't parse at byte 5: reserved byte for grow_memory must be zero, in function at index 0 (evaluating 'new WebAssembly.Module(wasm_code)') Module@[native code] ``` ### Expected Behavior The WebAssembly module should fail validation and report an error similar to: - Like gecko-dev: ```plaintext memory index out of range for memory.grow ``` - Like v8: ```plaintext CompileError: WebAssembly.Module(): Compiling function #0 failed: memory index 2816 exceeds number of declared memories (1) ``` 2085511 1 d_degazio 2025-01-07 11:05:55 -0800 It looks like we're still failing at validation time, just reporting a different error message? "must be zero" is more appropriate for WebKit at the moment than "out of range" because we do not yet support the WASM multi-memory proposal (tracked in https://bugs.webkit.org/show_bug.cgi?id=277743). 2085512 2 webkit-bug-importer 2025-01-07 11:06:18 -0800 <rdar://problem/142489712> 2090917 3 ysuzuki 2025-01-30 22:20:39 -0800 multi-memory is not implemented. 473821 2025-01-07 02:33:10 -0800 2025-01-07 02:33:10 -0800 program.js file_285505.txt text/plain 236 tombox1337 DQp2YXIgd2FzbV9jb2RlID0gbmV3IFVpbnQ4QXJyYXkoWzAsOTcsMTE1LDEwOSwxLDAsMCwwLDEs NCwxLDk2LDAsMCwzLDIsMSwwLDUsMywxLDAsMCwxMCwxMCwxLDgsMCw2NSwwLDY0LDEyOCwyMiwy NiwxMSxdKTsNCnZhciB3YXNtX21vZHVsZSA9IG5ldyBXZWJBc3NlbWJseS5Nb2R1bGUod2FzbV9j b2RlKTsNCnZhciB3YXNtX2luc3RhbmNlID0gbmV3IFdlYkFzc2VtYmx5Lkluc3RhbmNlKHdhc21f bW9kdWxlKTs=