Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: bfe5073f4c99579f6c21a68c606bea5cff94f072
https://github.com/WebKit/WebKit/commit/bfe5073f4c99579f6c21a68c606bea5cff94f072
Author: Sosuke Suzuki <[email protected]>
Date: 2026-08-03 (Mon, 03 Aug 2026)
Changed paths:
A JSTests/wasm/stress/multimemory-grow-during-partial-link.js
M Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h
Log Message:
-----------
[Wasm] `JSWebAssemblyInstance::updateCachedMemories()` crashes on a
partially-linked instance
https://bugs.webkit.org/show_bug.cgi?id=320857
Reviewed by Yusuke Suzuki.
setMemory() registers the instance as an anchor of each memory as soon as that
memory
slot is filled, while updateCachedMemories() walks every memory slot. Since
imports are
linked one by one, a grow can reach an instance whose remaining imported
memories are not
set yet -- from a later import's getter, or after a LinkError left the
half-linked instance
anchored -- and dereferences the null slots:
const mem0 = new WebAssembly.Memory({ initial: 1, maximum: 8 });
// module imports memories env:m0 and env:m1
try { new WebAssembly.Instance(module, { env: { m0: mem0, m1: 42 } }); }
catch { }
mem0.grow(0); // crash
Skip memory slots that are not set yet in updateCachedMemories() so that it can
be called
in the middle of instance construction.
* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h:
Canonical link: https://commits.webkit.org/318505@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
