[webkit-changes] [WebKit/WebKit] ed3069: [JSC] Missing Validation for Element Segment Initi...

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: ed30693f477a49f16b2678a5b400cc7e51f02398
      https://github.com/WebKit/WebKit/commit/ed30693f477a49f16b2678a5b400cc7e51f02398
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2025-01-24 (Fri, 24 Jan 2025)

  Changed paths:
    M JSTests/wasm/gc/const-exprs.js
    M JSTests/wasm/gc/simd.js
    A JSTests/wasm/stress/init-expr-cannot-include-non-import-globals.js
    M Source/JavaScriptCore/wasm/WasmConstExprGenerator.cpp
    M Source/JavaScriptCore/wasm/WasmSectionParser.cpp

  Log Message:
  -----------
  [JSC] Missing Validation for Element Segment Initialization
https://bugs.webkit.org/show_bug.cgi?id=285746
rdar://143128477

Reviewed by Keith Miller.

init-expr can only include imported globals.

* JSTests/wasm/stress/init-expr-cannot-include-non-import-globals.js: Added.
(shouldThrow):
* Source/JavaScriptCore/wasm/WasmConstExprGenerator.cpp:
(JSC::Wasm::ConstExprGenerator::getGlobal):
* Source/JavaScriptCore/wasm/WasmSectionParser.cpp:
(JSC::Wasm::SectionParser::parseInitExpr):

Canonical link: https://commits.webkit.org/289363@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications