[Webkit-unassigned] [Bug 263913] New: WebAssembly memory corruption on arm64 macOS and iOS

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=263913

            Bug ID: 263913
           Summary: WebAssembly memory corruption on arm64 macOS and iOS
           Product: WebKit
           Version: Safari 17
          Hardware: Mac (Apple Silicon)
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebAssembly
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: bvibber at wikimedia.org

While testing my WebAssembly media codecs library, I found that the AV1 decoder is failing in at least some cases on ARM64 Macs and iPhones running Safari, while it works as expected on x86_64 Macs and in Firefox or Chrome on ARM64 Macs.

The symptom is a failure of call_indirect signature validation, which likely indicates corruption of a function pointer via some earlier error.

I haven't been able to narrow down where/how exactly in the dav1d codec library code it's corrupting data, but have a very stable test case with a .wasm file, two packets of input data, and the surrounding JavaScript wrapper from emscripten:

Live test case: https://brionv.com/misc/wasm-safari-bug/


Test case with all component parts ready to run in a git repo: https://github.com/brion/wasm-safari-bug

Compiling dav1d with -O2 or -Os avoids the bug, but since it runs correctly in other browsers and in WebKit on x86_64 I think it's not likely to be a clang/llvm issue.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20231030/f1c6676d/attachment.htm>