Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: aa8167a2feb9a49f5380353389324102f2a63462
https://github.com/WebKit/WebKit/commit/aa8167a2feb9a49f5380353389324102f2a63462
Author: Yusuke Suzuki <[email protected]>
Date: 2026-08-07 (Fri, 07 Aug 2026)
Changed paths:
A JSTests/wasm/stress/table-oversized-initial-reflection.js
M Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
M Source/JavaScriptCore/wasm/WasmFormat.h
M Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp
M Source/JavaScriptCore/wasm/WasmSectionParser.cpp
M Source/JavaScriptCore/wasm/WasmTable.cpp
M Source/JavaScriptCore/wasm/WasmTable.h
M Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp
Log Message:
-----------
[JSC] Table64 size should be checked when creating / growing, not parsing
https://bugs.webkit.org/show_bug.cgi?id=321338
rdar://184367247
Reviewed by Yijia Huang.
Clamping the table size at parsing time will cause incorrect table size
reporting. The correct behavior is (1) parsing should accept, it is just
declaration and then (2) creating a table actually should reject it.
This patch fixes this issue.
Test: JSTests/wasm/stress/table-oversized-initial-reflection.js
* JSTests/wasm/stress/table-oversized-initial-reflection.js: Added.
(leb):
(section):
(importedTable):
(exportedTable):
(checkMinimum):
(true.assert.throws.new.WebAssembly.Instance.new.WebAssembly.Module.importedTable):
* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:
(JSC::Wasm::BBQJITImpl::BBQJIT::addCallIndirect):
* Source/JavaScriptCore/wasm/WasmFormat.h:
(JSC::Wasm::TableInformation::TableInformation):
(JSC::Wasm::TableInformation::initial const):
* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:
(JSC::Wasm::OMGIRGenerator::addCallIndirect):
* Source/JavaScriptCore/wasm/WasmSectionParser.cpp:
(JSC::Wasm::SectionParser::parseTableHelper):
* Source/JavaScriptCore/wasm/WasmTable.cpp:
(JSC::Wasm::Table::tryCreate):
* Source/JavaScriptCore/wasm/WasmTable.h:
* Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp:
(JSC::WebAssemblyModuleRecord::initializeImports):
Canonical link: https://commits.webkit.org/318834@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
