Created attachment 464306 [details] Reproducible poc ASSERTION FAILED: cell /Users/x/Desktop/AFL-WASM-main/WebKit_patch/Source/JavaScriptCore/runtime/JSObject.h(1363) : JSC::JSObject *JSC::asObject(JSC::JSCell *) 1 0x10bf45b58 WTFCrash 2 0x109cebd30 JSC::ARM64Assembler::insn(int) 3 0x109cbbfd8 JSC::asObject(JSC::JSCell*) 4 0x109cbbf60 JSC::asObject(JSC::JSValue) 5 0x10b542ea4 JSC::Register::object() const 6 0x109c9f524 JSC::CallFrame::jsCallee() const 7 0x10b396b88 JSC::CallFrame::isStackOverflowFrame() const 8 0x10afd8460 JSC::StackVisitor::StackVisitor(JSC::CallFrame*, JSC::VM&) 9 0x10afd888c JSC::StackVisitor::StackVisitor(JSC::CallFrame*, JSC::VM&) 10 0x10afcfd6c void JSC::StackVisitor::visit<(JSC::StackVisitor::EmptyEntryFrameAction)0, JSC::Interpreter::getStackTrace(JSC::JSCell*, WTF::Vector<JSC::StackFrame, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, unsigned long, unsigned long)::$_6>(JSC::CallFrame*, JSC::VM&, JSC::Interpreter::getStackTrace(JSC::JSCell*, WTF::Vector<JSC::StackFrame, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, unsigned long, unsigned long)::$_6 const&) 11 0x10afcfc14 JSC::Interpreter::getStackTrace(JSC::JSCell*, WTF::Vector<JSC::StackFrame, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, unsigned long, unsigned long) 12 0x10b48e128 JSC::getStackTrace(JSC::JSGlobalObject*, JSC::VM&, JSC::JSObject*, bool) 13 0x10b4908bc JSC::ErrorInstance::finishCreation(JSC::VM&, JSC::JSGlobalObject*, WTF::String const&, JSC::JSValue, WTF::String (*)(WTF::String const&, WTF::StringView, JSC::RuntimeType, JSC::ErrorInstance::SourceTextWhereErrorOccurred), JSC::RuntimeType, bool) 14 0x10bdf56a0 JSC::ErrorInstance::create(JSC::JSGlobalObject*, JSC::VM&, JSC::Structure*, WTF::String const&, JSC::JSValue, WTF::String (*)(WTF::String const&, WTF::StringView, JSC::RuntimeType, JSC::ErrorInstance::SourceTextWhereErrorOccurred), JSC::RuntimeType, JSC::ErrorType, bool) 15 0x10bdf889c JSC::createJSWebAssemblyRuntimeError(JSC::JSGlobalObject*, JSC::VM&, JSC::Wasm::ExceptionType) 16 0x10bd5c394 operationWasmToJSException 17 0x10bd8cfb0 slow_path_wasm_throw_exception 18 0x109b77f44 wasmLLIntPCRangeStart 19 0x100000000 (null)
<rdar://problem/103834422>
This poc crashes the jsc on ARM64 commit: 8bacbc1a234b
<rdar://problem/103834490>
friendly ping
Created attachment 464433 [details] Simple poc Nice catch! 1) This test case requires both SIMD and tail calls 2) I am guessing that many of these bugs all stem from the same source 3) I have attached a super simple poc: (module (func $start (export "start") (call $f1)) (func $f1 (local v128) (try (do) (catch_all)) (return_call $f2)) (func $f2) )
Created attachment 464434 [details] Simple poc driver
This is tail-call specific issue. Let's just fix it in public repository since it isn't shipped yet.
Pull request: https://github.com/WebKit/WebKit/pull/8450
All the spec this POC required is enabled by DEFAULT, so I think the spec is READY to ship. The security label need to be kept anyway.
Committed 258725@main (0eced4e49803): <https://commits.webkit.org/258725@main> Reviewed commits have been landed. Closing PR #8450 and removing active labels.
(In reply to CAO ZONG from comment #9) > All the spec this POC required is enabled by DEFAULT, so I think the spec is > READY to ship. The security label need to be kept anyway. Hi Cao, it's not considered a security issue because this is newly developed code that has not been deployed on any platforms yet. Thanks for reporting the bug.
(In reply to Mark Lam from comment #11) > (In reply to CAO ZONG from comment #9) > > All the spec this POC required is enabled by DEFAULT, so I think the spec is > > READY to ship. The security label need to be kept anyway. > > Hi Cao, it's not considered a security issue because this is newly developed > code that has not been deployed on any platforms yet. Thanks for reporting > the bug. Hello Mark! Well, According to Apple Security Bounty Guidelines "For example, security issues that are unique to newly added features or code in developer or public beta releases — including newly introduced regressions...", I think the bug in newly developed code need also considered for security impact. So will this issue be assigned CVE or any acknowledge?
(In reply to CAO ZONG from comment #12) > (In reply to Mark Lam from comment #11) > > (In reply to CAO ZONG from comment #9) > > > All the spec this POC required is enabled by DEFAULT, so I think the spec is > > > READY to ship. The security label need to be kept anyway. > > > > Hi Cao, it's not considered a security issue because this is newly developed > > code that has not been deployed on any platforms yet. Thanks for reporting > > the bug. > > Hello Mark! > Well, According to Apple Security Bounty Guidelines "For example, security > issues that are unique to newly added features or code in developer or > public beta releases — including newly introduced regressions...", I think > the bug in newly developed code need also considered for security impact. So > will this issue be assigned CVE or any acknowledge? The WebKit open source project does not and cannot speak for Apple Security. Please contact them for clarification. Thanks.
(In reply to Mark Lam from comment #13) > (In reply to CAO ZONG from comment #12) > > (In reply to Mark Lam from comment #11) > > > (In reply to CAO ZONG from comment #9) > > > > All the spec this POC required is enabled by DEFAULT, so I think the spec is > > > > READY to ship. The security label need to be kept anyway. > > > > > > Hi Cao, it's not considered a security issue because this is newly developed > > > code that has not been deployed on any platforms yet. Thanks for reporting > > > the bug. > > > > Hello Mark! > > Well, According to Apple Security Bounty Guidelines "For example, security > > issues that are unique to newly added features or code in developer or > > public beta releases — including newly introduced regressions...", I think > > the bug in newly developed code need also considered for security impact. So > > will this issue be assigned CVE or any acknowledge? > > The WebKit open source project does not and cannot speak for Apple Security. > Please contact them for clarification. Thanks. OK, and thanks for your patient reply :)
*** Bug 249700 has been marked as a duplicate of this bug. ***
*** Bug 249935 has been marked as a duplicate of this bug. ***
*** Bug 250008 has been marked as a duplicate of this bug. ***
*** Bug 249762 has been marked as a duplicate of this bug. ***