| Summary: | [ARMv7] SHOULD NEVER BE REACHED in Expected<JSC::Wasm::PageCount, JSC::Wasm::Memory::GrowFailReason> JSC::Wasm::Memory::growShared(JSC::Wasm::PageCount) | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Mikhail R. Gadelha <mikhail> | ||||
| Component: | JavaScriptCore | Assignee: | Yusuke Suzuki <ysuzuki> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | bfulgham, webkit-bug-importer, ysuzuki | ||||
| Priority: | P2 | Keywords: | InRadar | ||||
| Version: | WebKit Nightly Build | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Attachments: |
|
||||||
This crash is because ARMv7 port incorrectly enabled shared Wasm memory. This does not happen in ARM64 and x64. Changing it to normal bug since it is release-assert. This is ARMv7 specific Linux only issue by https://github.com/WebKit/WebKit/commit/b58fb7e9473cc9227e4d52d17e93f25a3970522e Pull request: https://github.com/WebKit/WebKit/pull/2341 Committed 252395@main (12ed8dc6d020): <https://commits.webkit.org/252395@main> Reviewed commits have been landed. Closing PR #2341 and removing active labels. |
Created attachment 460796 [details] Testcase Found by Igalia Fuzzing Campaign. The attached test case fails with the following message: SHOULD NEVER BE REACHED WebKit//Source/JavaScriptCore/wasm/WasmMemory.cpp(503) : Expected<JSC::Wasm::PageCount, JSC::Wasm::Memory::GrowFailReason> JSC::Wasm::Memory::growShared(JSC::Wasm::PageCount)