285746 2025-01-10 07:28:53 -0800 Missing Validation for Element Segment Initialization 2025-02-10 13:52:26 -0800 1 1 1 Unclassified WebKit WebAssembly Other Unspecified Unspecified RESOLVED INVALID InRadar P2 Normal --- 287432 1 tombox1337 ysuzuki commit-queue d_degazio keith_miller mark.lam webkit-bug-importer ysuzuki oldest_to_newest 2086347 0 473855 tombox1337 2025-01-10 07:28:53 -0800 Created attachment 473855 program.js ### Description WebKit does not enforce the restriction that element segment initializers can only reference imported globals. According to the [WebAssembly specification](https://webassembly.github.io/spec/core/valid/instructions.html#constant-expressions), globals are not recursive and cannot be accessed within constant expressions when they are defined locally, affecting the initialization of element segments. ### Environment - OS: Ubuntu 20.04 - CPU: amd64 - WebKit Version: 146fa28a329d220785d2972c1d691555141e6406 ### Steps to Reproduce Run the following WebAssembly module: ``` ./JSCOnly/Debug/bin/jsc ./program.js ``` ### Current State ```plaintext (no error or warning) ``` ### Expected Behavior Per the [WebAssembly specification](https://webassembly.github.io/spec/core/valid/instructions.html#constant-expressions), element segment initializers should only be able to reference imported globals. If a locally defined global is accessed, the module should fail validation with an error similar to: ``` initializer expression can only reference an imported global ``` 2088035 1 webkit-bug-importer 2025-01-17 07:29:12 -0800 <rdar://problem/143128477> 2089472 2 ysuzuki 2025-01-24 00:41:46 -0800 Pull request: https://github.com/WebKit/WebKit/pull/39491 2089619 3 ews-feeder 2025-01-24 13:18:05 -0800 Committed 289363@main (ed30693f477a): <https://commits.webkit.org/289363@main> Reviewed commits have been landed. Closing PR #39491 and removing active labels. 2093599 4 commit-queue 2025-02-10 13:28:41 -0800 Re-opened since this is blocked by bug 287432 2093612 5 ysuzuki 2025-02-10 13:52:26 -0800 This is changed in wasm GC. 473855 2025-01-10 07:28:53 -0800 2025-01-10 07:28:53 -0800 program.js program.js application/x-javascript 416 tombox1337 CnZhciB3YXNtX2NvZGUgPSBuZXcgVWludDhBcnJheShbMCw5NywxMTUsMTA5LDEsMCwwLDAsMSw1 LDEsOTYsMCwxLDEyNywzLDIsMSwwLDQsNCwxLDExMiwwLDEsNiw2LDEsMTI3LDAsNjUsMCwxMSw3 LDgsMSw0LDEwOSw5NywxMDUsMTEwLDAsMCw5LDcsMSwwLDM1LDAsMTEsMSwwLDEwLDYsMSw0LDAs NjUsMSwxMSwwLDE0LDQsMTEwLDk3LDEwOSwxMDEsMSw3LDEsMCw0LDEwOSw5NywxMDUsMTEwLF0p Owp2YXIgd2FzbV9tb2R1bGUgPSBuZXcgV2ViQXNzZW1ibHkuTW9kdWxlKHdhc21fY29kZSk7CnZh ciB3YXNtX2luc3RhbmNlID0gbmV3IFdlYkFzc2VtYmx5Lkluc3RhbmNlKHdhc21fbW9kdWxlKTsK Y29uc3QgeyAnbWFpbic6IGZ1bmMgfSA9IHdhc21faW5zdGFuY2UuZXhwb3J0czsKdmFyIGEgPSBm dW5jKCk7CnByaW50KGEpOwo=