Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: bf0425598904dd7ae7929e7e9e4ac248d93b9bdd
https://github.com/WebKit/WebKit/commit/bf0425598904dd7ae7929e7e9e4ac248d93b9bdd
Author: Cole Carley <[email protected]>
Date: 2026-07-30 (Thu, 30 Jul 2026)
Changed paths:
A JSTests/wasm/stress/memory64-oversized-limits.js
M Source/JavaScriptCore/runtime/PageCount.h
M Source/JavaScriptCore/wasm/WasmLimits.h
M Source/JavaScriptCore/wasm/WasmSectionParser.cpp
Log Message:
-----------
[Memory64] Expand memory's declared limits in Memory64 case
https://bugs.webkit.org/show_bug.cgi?id=320681
rdar://183666875
Reviewed by Keith Miller.
We rejected at parse time any memory declaring more than 65,536 pages,
regardless of index type. This is right for only the memory32 case.
The JS API limits a 64-bit memory's min and max to 2^37-1 pages, which
is far more than can be allocated. Such a module must compile and fail
at instantiation instead.
Bound the declared limits by index type in the memory section parser, using
new limits in WasmLimits.h alongside the other JS API limits it mirrors. A
declaration above what can be allocated is still rejected by
Memory::tryCreate(), matching how oversized table sizes are handled.
PageCount's sentinel for "no page count" moves from UINT_MAX to UINT64_MAX:
2^32-1 pages is now a legal declared page count, so it can no longer double
as the sentinel.
Note that memory64.wast.js still fails at memory64.wast:8 and :9, which
declare 2^48 pages. That is the core spec's bound; the JS API's is lower, and
the imported wasm/core tests do not account for it. This behavior matches
Chrome, and FireFox.
* JSTests/wasm/stress/memory64-oversized-limits.js: Added.
(leb128):
(moduleBytesWithMemoryLimits):
* Source/JavaScriptCore/runtime/PageCount.h:
(JSC::PageCount::PageCount):
(JSC::PageCount::operator bool const):
* Source/JavaScriptCore/wasm/WasmLimits.h:
* Source/JavaScriptCore/wasm/WasmSectionParser.cpp:
(JSC::Wasm::SectionParser::parseMemoryHelper):
Canonical link: https://commits.webkit.org/318282@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
