Bug 308792 – Incorrect Maximum Value for WASM Element Section

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

Created attachment 478507 [details]
test.js

`jsc (JavaScriptCore)` fails to reject an invalid WebAssembly module. Specifically, the module contains an element segment with 10,000,001 entries, exceeding the specification maximum of 10,000,000 table entries in any table initialization. According to the WebAssembly specification, maximum number of table entries in any table initialization is 10,000,000.


### Environment

* OS: Ubuntu 20.04
* CPU: amd64
* jsc (JavaScriptCore) version: `6bcc4ed97d73`
* Commands:
```bash
WebKit/WebKitBuild/JSCOnly/Debug/bin/jsc test.js
```


### Actual behavior

`jsc (JavaScriptCore)` incorrectly accepts this invalid module (exit code 0). The output is:

```
42
```

### Expected behavior

The runtime should reject this module during validation because the module violates the specification.
For reference, `js (SpiderMonkey)` correctly rejects it (exit code 3):

```
CompileError: at offset 50: too many elements in element segment
Stack:
  @/tmp/spec_limits/max_table_entries_in_any_table_initialization_negative_gecko.js:2:19
```

[Radar WebKit Bug Importer]

<rdar://problem/171324747>

[Shu-yu Guo]

It is not a security issue if we do not adhere to an arbitrarily determined spec limit.

[Shu-yu Guo]

Pull request: https://github.com/WebKit/WebKit/pull/59627

[EWS]

Committed 308473@main (3e5413522e4c): <https://commits.webkit.org/308473@main>

Reviewed commits have been landed. Closing PR #59627 and removing active labels.