[webkit-changes] [WebKit/WebKit] 3a0671: Add missing stack check to bbq->omg OSR

[Justin Michaud]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 3a0671fdf83143eb848ccf3e2f565d2fd4bded7b
      https://github.com/WebKit/WebKit/commit/3a0671fdf83143eb848ccf3e2f565d2fd4bded7b
  Author: Justin Michaud <justin_michaud at apple.com>
  Date:   2024-03-25 (Mon, 25 Mar 2024)

  Changed paths:
    A JSTests/wasm/stress/omg-stack-overflow.js
    A JSTests/wasm/stress/omg-stack-overflow.wasm
    M Source/JavaScriptCore/wasm/WasmOperations.cpp

  Log Message:
  -----------
  Add missing stack check to bbq->omg OSR
https://bugs.webkit.org/show_bug.cgi?id=270605
rdar://124060272

Reviewed by Keith Miller.

In https://commits.webkit.org/272448.466@safari-7618-branch, we turned
a stack overflow during OSR entry into a crash, preventing a security
issue. While the crash prevents memory corruption, it should never
happen. This patch fixes a case that was missed in the first patch.

Note: the test case currently runs forever, so it is skipped until
we fix the watchdog in wasm.

* JSTests/wasm/stress/omg-stack-overflow.js: Added.
(globalThis.callerIsBBQOrOMGCompiled.instantiateJsc):
(else.instantiateBrowser):
(async let):
* JSTests/wasm/stress/omg-stack-overflow.wasm: Added.
* Source/JavaScriptCore/wasm/WasmOperations.cpp:
(JSC::Wasm::JSC_DEFINE_JIT_OPERATION):

Originally-landed-as: 272448.704 at safari-7618-branch (36930ea8be72). rdar://125261536
Canonical link: https://commits.webkit.org/276645@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications