← WebKit — 2026-W36
8d7690313428622089078027c9a1b5058e2428b6 JavaScriptCore: Wasm IPInt br_table stack-depth metadata abort
severity low
class IntegerOverflow
confidence 0.5
signal score 6.65
Source/JavaScriptCore/wasm
Primitive: WASM IPInt branch toPop count unchecked before narrowing cast
Triage note: branchTargetMetadataFor computes toPop as Checked<uint32_t> and validates isInBounds before narrowing, returning a validation error instead of the prior safeCast<uint16_t>(m_stackSize - stackSize - arity) that RELEASE_ASSERTs. Converts a reachable assert/DoS on a crafted module into a graceful bytecode-validation failure; no memory corruption.
Triage note: branchTargetMetadataFor computes toPop as Checked<uint32_t> and validates isInBounds before narrowing, returning a validation error instead of the prior safeCast<uint16_t>(m_stackSize - stackSize - arity) that RELEASE_ASSERTs. Converts a reachable assert/DoS on a crafted module into a graceful bytecode-validation failure; no memory corruption.
Structural signals: checked_int (+4.06), null_guard (+2.59)
Commit message
JavaScriptCore: Wasm IPInt br_table stack-depth metadata abort
https://bugs.webkit.org/show_bug.cgi?id=318522
rdar://181294123
Reviewed by Marcus Plutowski.
IPInt encodes the number of wasm stack values to drop on a take branch
as a uint16. Right now, if that limit is exceeded we RELEASE_ASSERT.
This patch instead makes that a validation error. Since every tier
passes through the IPInt we don't need to re-check in subsequent tiers,
if we ever change the behavior it happens all in one place. An
alternative I considered was to limit the size of the wasm stack to
uint16_t but that seemed more likely to cause compatibility issues so
I'd rather do that in a follow up on main.
Test: JSTests/wasm/stress/ipint-branch-deep-stack-metadata.js
Identifier: 316606.593@safari-7625-branch
Before / after
Loading diff…
On This Page