[Webkit-unassigned] [Bug 260516] New: [WASM] SEGV in JSC::Wasm::FunctionParser<JSC::Wasm::LLIntGenerator>::parseExpression
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Tue Aug 22 05:29:21 PDT 2023
https://bugs.webkit.org/show_bug.cgi?id=260516
Bug ID: 260516
Summary: [WASM] SEGV in
JSC::Wasm::FunctionParser<JSC::Wasm::LLIntGenerator>::
parseExpression
Product: WebKit
Version: WebKit Local Build
Hardware: Unspecified
OS: Unspecified
Status: NEW
Severity: Normal
Priority: P2
Component: WebAssembly
Assignee: webkit-unassigned at lists.webkit.org
Reporter: cz18811105578 at gmail.com
Created attachment 467386
--> https://bugs.webkit.org/attachment.cgi?id=467386&action=review
Reproducible poc
Commit: 5466cd2c24514bdeee05075d5a2eb35e8c146e40
Run Flag: --useWebAssemblyTypedFunctionReferences=true --useWebAssemblyGC=true
Backtrace:
```
#0 JSC::Wasm::FunctionParser<JSC::Wasm::LLIntGenerator>::parseExpression (this=this at entry=0x7fffa8a78348) at ../../Source/JavaScriptCore/wasm/WasmFunctionParser.h:2728
#1 0x0000555557f34f4b in JSC::Wasm::FunctionParser<JSC::Wasm::LLIntGenerator>::parseBody (this=this at entry=0x7fffa8a78348) at ../../Source/JavaScriptCore/wasm/WasmFunctionParser.h:366
#2 0x0000555557ecb64e in JSC::Wasm::FunctionParser<JSC::Wasm::LLIntGenerator>::parse (this=this at entry=0x7fffa8a78348) at ../../Source/JavaScriptCore/wasm/WasmFunctionParser.h:336
#3 0x0000555557ec9edf in JSC::Wasm::parseAndCompileBytecode (functionStart=0x7fffec00f480 "", functionLength=<optimized out>, signature=..., info=...,
functionIndex=functionIndex at entry=0x0) at ../../Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp:580
#4 0x0000555557fff3ba in JSC::Wasm::LLIntPlan::compileFunction (this=0x7fffec05d200, functionIndex=0x0) at ../../Source/JavaScriptCore/wasm/WasmLLIntPlan.cpp:89
#5 0x0000555557eaebd6 in JSC::Wasm::EntryPlan::compileFunctions (this=0x7fffec05d200, effort=<optimized out>) at ../../Source/JavaScriptCore/wasm/WasmEntryPlan.cpp:218
#6 0x000055555809a50f in JSC::Wasm::Worklist::Thread::work (this=0x7fffec02e1b0) at ../../Source/JavaScriptCore/wasm/WasmWorklist.cpp:111
#7 0x00005555582308b0 in WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0::operator()() const (this=<optimized out>) at ../../Source/WTF/wtf/AutomaticThread.cpp:229
#8 WTF::Detail::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0, void>::call() (this=<optimized out>) at ../../Source/WTF/wtf/Function.h:53
#9 0x00005555582763a9 in WTF::Function<void ()>::operator()() const (this=<optimized out>) at ../../Source/WTF/wtf/Function.h:82
#10 WTF::Thread::entryPoint (newThreadContext=0x7fffec02ebb0) at ../../Source/WTF/wtf/Threading.cpp:250
#11 0x0000555558339543 in WTF::wtfThreadEntryPoint (context=0x5555587a53bc) at ../../Source/WTF/wtf/posix/ThreadingPOSIX.cpp:242
#12 0x00007ffff5fd8609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
#13 0x00007ffff5ba5133 in clone () from /lib/x86_64-linux-gnu/libc.so.6
```
Segment fault when visitng the field of object inlineSignature while it is NULL.
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20230822/14fad708/attachment-0001.htm>
More information about the webkit-unassigned
mailing list