Bug 299393 – Wasm validator disallows name imports longer than 100_000 bytes

• Component: WebAssembly
• Status: RESOLVED FIXED

[Martin Kustermann]

We have a dart2wasm compiler and noticed on some programs that JSC (command line shell) results in a validation error. The root cause of it is that it refuses import names longer than 100_000 bytes.

Normally imported names are surely short.

Though the recent js-string-builtin wasm spec enables a magic import mechanism where one can import JS strings via specially recognized imports. (Although JSC may(?) not support js-string-builtins yet, it can be polyfilled on the JS side)

String constants in Dart applications can exceed 100_000 bytes and cause a wasm validation error. The root cause is due to using of the constant in [0] when decoding import names.

[0] https://github.com/WebKit/WebKit/blob/68dbd317f3d24b03f06a82b11fddd2bb6e7a33b5/Source/JavaScriptCore/wasm/WasmLimits.h#L54

Expected results:

Looking through the core wasm spec and js-wasm spec (https://webassembly.github.io/spec/js-api/index.html#limits) it's unclear where this 100_000 byte limit comes from.

Can it be that this is not specified?

D8/Chrome doesn't have this issue: It loads & runs such modules just fine.

[Radar WebKit Bug Importer]

<rdar://problem/161683448>

[Radar WebKit Bug Importer]

<rdar://problem/161683389>

[Shu-yu Guo]

Going by the git blame it seems like these limits were copied from V8 for compat reasons during the early days of Wasm. Indeed the constant still exists in V8 [1] but it seems like it was never (?) used. We'll investigate removing this limit.

[1] https://source.chromium.org/chromium/chromium/src/+/main:v8/src/wasm/wasm-limits.h;l=49;drc=d78d6f646dee0f68dcc59eed2d7de0f910e2fe2a

[Shu-yu Guo]

Pull request: https://github.com/WebKit/WebKit/pull/51687

[EWS]

Committed 300897@main (81ff731cd920): <https://commits.webkit.org/300897@main>

Reviewed commits have been landed. Closing PR #51687 and removing active labels.