Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b44e37ce8f99bf4f83f4d28f8a1e3ab9e99a93aa
https://github.com/WebKit/WebKit/commit/b44e37ce8f99bf4f83f4d28f8a1e3ab9e99a93aa
Author: Anand Srinivasan <[email protected]>
Date: 2026-07-01 (Wed, 01 Jul 2026)
Changed paths:
M Source/JavaScriptCore/wasm/WasmIPIntGenerator.cpp
Log Message:
-----------
Change IPInt m_pendingOffset to std::optional and add metadata offset
overflow assertions
https://bugs.webkit.org/show_bug.cgi?id=313590
rdar://175673870
Reviewed by Dan Hecht.
IPIntControlType::m_pendingOffset was int32_t but stored values from
m_metadata->m_metadata.size(). A function within maxFunctionSize can
generate metadata exceeding INT32_MAX via repeated calls to functions
with large signatures.
Add overflow checks to the 32 bit computations to avoid silently
producing invalid metadata addresses, and change m_pendingOffset to use
std::optional instead of a sentinel value.
A practical test would take too long to include.
* Source/JavaScriptCore/wasm/WasmIPIntGenerator.cpp:
(JSC::Wasm::IPIntGenerator::tryToResolveBranchTarget):
(JSC::Wasm::IPIntGenerator::curPC):
(JSC::Wasm::IPIntGenerator::nextPC):
(JSC::Wasm::IPIntGenerator::curMC):
(JSC::Wasm::IPIntGenerator::checkedDelta):
(JSC::Wasm::IPIntGenerator::coalesceControlFlow):
(JSC::Wasm::IPIntGenerator::resolveEntryTarget):
(JSC::Wasm::IPIntGenerator::resolveExitTarget):
(JSC::Wasm::IPIntGenerator::addLoop):
(JSC::Wasm::IPIntGenerator::addIf):
(JSC::Wasm::IPIntGenerator::addElseToUnreachable):
(JSC::Wasm::IPIntGenerator::addCatchToUnreachable):
(JSC::Wasm::IPIntGenerator::addCatchAllToUnreachable):
(JSC::Wasm::IPIntGenerator::addDelegateToUnreachable):
(JSC::Wasm::IPIntGenerator::addEndToUnreachable):
Originally-landed-as: 305413.828@safari-7624-branch (d446d220d636).
rdar://180428054
Canonical link: https://commits.webkit.org/316298@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
