RESOLVED FIXED308732
Incorrect Maximum Value for WASM Table Section 
https://bugs.webkit.org/show_bug.cgi?id=308732
Summary Incorrect Maximum Value for WASM Table Section
tombox1337
Reported 2026-02-26 04:20:08 PST
Created attachment 478491 [details] test.js `jsc (JavaScriptCore)` fails to reject an invalid WebAssembly module involving the `table section`. Specifically, the module declares 100,001 tables, exceeding the specification maximum of 100,000. According to the WebAssembly specification, the maximum number of tables in a module is 100,000. ### Environment * OS: Ubuntu 20.04 * CPU: amd64 * jsc (JavaScriptCore) version: `6bcc4ed97d73` * Commands: ```bash WebKit/WebKitBuild/JSCOnly/Debug/bin/jsc test.js ``` ### Actual behavior `jsc (JavaScriptCore)` incorrectly accepts this invalid module (exit code 0). The output is: ``` 42 ``` ### Expected behavior The runtime should reject this module during validation because the module violates the specification. For reference, `js (SpiderMonkey)` correctly rejects it (exit code 3): ``` CompileError: at offset 300039: too many tables ```
Attachments
test.js (781.67 KB, application/x-javascript)
2026-02-26 04:20 PST, tombox1337 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Alexey Proskuryakov
Comment 1 2026-02-26 08:32:33 PST
*** Bug 308733 has been marked as a duplicate of this bug. ***
Radar WebKit Bug Importer
Comment 2 2026-03-05 04:21:11 PST
<rdar://problem/171801338>
anand_srinivasan
Comment 3 2026-03-06 16:51:46 PST
Pull request: https://github.com/WebKit/WebKit/pull/60109
EWS
Comment 4 2026-03-09 10:23:51 PDT
Committed 308922@main (0691f940a6f7): <https://commits.webkit.org/308922@main> Reviewed commits have been landed. Closing PR #60109 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.