Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 47f20d8cfd63af0e383c7094c03189100d3253f7
https://github.com/WebKit/WebKit/commit/47f20d8cfd63af0e383c7094c03189100d3253f7
Author: Sosuke Suzuki <[email protected]>
Date: 2026-08-11 (Tue, 11 Aug 2026)
Changed paths:
M JSTests/wasm/stress/unreachable-immediates-validation.js
M Source/JavaScriptCore/wasm/WasmFunctionParser.h
Log Message:
-----------
[Wasm] `call_indirect` in unreachable code should validate the table element
type and the signature kind
https://bugs.webkit.org/show_bug.cgi?id=321416
Reviewed by Yusuke Suzuki.
parseUnreachableExpression's CallIndirect case checked table existence and
the bounds of both immediates, but not that the table holds funcref or that
the type index names a function type, so these invalid modules compiled when
the call_indirect was dead code:
(table 1 externref)
(func unreachable (call_indirect (type 0))) ;; accepted
(type (func)) (type (struct))
(table 1 funcref)
(func unreachable (call_indirect (type 1))) ;; accepted
The reachable path rejects both. Move the immediate checks into
parseCallIndirectImmediates and use it from both parseExpression and
parseUnreachableExpression so the two paths cannot drift again.
* JSTests/wasm/stress/unreachable-immediates-validation.js:
(moduleBytes):
* Source/JavaScriptCore/wasm/WasmFunctionParser.h:
(JSC::Wasm::FunctionParser<Context>::parseCallIndirectImmediates):
(JSC::Wasm::FunctionParser<Context>::parseExpression):
(JSC::Wasm::FunctionParser<Context>::parseUnreachableExpression):
Canonical link: https://commits.webkit.org/318962@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
