Summary: | WebAssembly memory corruption on arm64 macOS and iOS | ||
---|---|---|---|
Product: | WebKit | Reporter: | Brooke Vibber <bvibber> |
Component: | WebAssembly | Assignee: | Nobody <webkit-unassigned> |
Status: | RESOLVED FIXED | ||
Severity: | Normal | CC: | justin_michaud, keith_miller, mark.lam, webkit-bug-importer |
Priority: | P2 | Keywords: | InRadar |
Version: | Safari 17 | ||
Hardware: | Mac (Apple Silicon) | ||
OS: | Unspecified |
Description
Brooke Vibber
2023-10-30 12:45:32 PDT
Hi Brion, which version of WebKit did you saw this issue on? Is it the Safari 17 that came with a macOS install (which one)? Or is it on a local WebKit build? (In reply to Mark Lam from comment #2) > Hi Brion, which version of WebKit did you saw this issue on? Is it the > Safari 17 that came with a macOS install (which one)? Or is it on a local > WebKit build? I have so far reproduced it in: * macOS 14.1's stock Safari * iOS 17.1's stock Safari * a local WebKit build from main a few days ago * WebKit nightly builds from a few days ago, 3 months ago, and 6 months ago Also the current Safari Technology Preview exhibits the bug on my M1 MacBook Air. You are right, this is a JSC bug. Thank you so much for reporting this, and for making such a tidy reproduction repo. I cannot explain how much easier that makes this. I was able to reproduce on a very recent nightly build. This configuration also makes the issue go away: __XPC_JSC_useBBQJIT=0 __XPC_JSC_useConcurrentJIT=0 run-safari -ExtensionsEnabled NO This of course reproduces the issue: __XPC_JSC_useBBQJIT=1 __XPC_JSC_useOMGJIT=0 __XPC_JSC_useConcurrentJIT=0 run-safari -ExtensionsEnabled NO This looks like a BBQ bug, which is our new baseline compiler tier that was introduced in macOS 17. Thanks again, I will try to bisect which function is the cause. (In reply to Justin Michaud from comment #5) > You are right, this is a JSC bug. > > Thank you so much for reporting this, and for making such a tidy > reproduction repo. I cannot explain how much easier that makes this. ... > This looks like a BBQ bug, which is our new baseline compiler tier that was > introduced in macOS 17. > > Thanks again, I will try to bisect which function is the cause. oh good I'm glad the repro is workable! it's always tough chopping down these big code blobs ;) :D Hey! Thank you so much for this repro case, it was very helpful in determining the root cause of a few different bugs. Sorry for the delay in responding publicly. The fix was landed here: https://github.com/WebKit/WebKit/pull/22029 Cheers! Woohoo! Thanks for the fix. :D |