Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[JSC][32bit] ASSERTION FAILED: !initialBytes #3275

Conversation

mikhailramalho
Copy link
Contributor

@mikhailramalho mikhailramalho commented Aug 12, 2022

3866ba7

[JSC][32bit] ASSERTION FAILED: !initialBytes
https://bugs.webkit.org/show_bug.cgi?id=243901

Reviewed by Yusuke Suzuki.

This patch fixes a value being truncated in 32bits platforms, resulting
in a invalid maximum size.

The method bytes() returns a uint64_t but in Memory::tryCreate, it is
stored in size_t, which is fine in 64bit platforms but gets truncated in
32 bits ones.

In this patch both initialBytes and maximumBytes are now uint64_t and
there is an extra check if the maximum size is greater than what's
allowed in the platform.

* Source/JavaScriptCore/wasm/WasmMemory.cpp:
(JSC::Wasm::Memory::tryCreate):

Canonical link: https://commits.webkit.org/253399@main

@mikhailramalho mikhailramalho requested a review from a team as a code owner August 12, 2022 22:01
@mikhailramalho mikhailramalho self-assigned this Aug 12, 2022
@mikhailramalho mikhailramalho added JavaScriptCore For bugs in JavaScriptCore, the JS engine used by WebKit, other than kxmlcore issues. WebKit Nightly Build labels Aug 12, 2022
@mikhailramalho mikhailramalho force-pushed the eng/JSC32bit-ASSERTION-FAILED-initialBytes branch from 77aa9fd to a57c2ac Compare August 12, 2022 23:17
Copy link
Member

@Constellation Constellation left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

r=me

@mikhailramalho mikhailramalho added the merge-queue Applied to send a pull request to merge-queue label Aug 12, 2022
@webkit-early-warning-system webkit-early-warning-system force-pushed the eng/JSC32bit-ASSERTION-FAILED-initialBytes branch from a57c2ac to d60c87c Compare August 13, 2022 02:43
https://bugs.webkit.org/show_bug.cgi?id=243901

Reviewed by Yusuke Suzuki.

This patch fixes a value being truncated in 32bits platforms, resulting
in a invalid maximum size.

The method bytes() returns a uint64_t but in Memory::tryCreate, it is
stored in size_t, which is fine in 64bit platforms but gets truncated in
32 bits ones.

In this patch both initialBytes and maximumBytes are now uint64_t and
there is an extra check if the maximum size is greater than what's
allowed in the platform.

* Source/JavaScriptCore/wasm/WasmMemory.cpp:
(JSC::Wasm::Memory::tryCreate):

Canonical link: https://commits.webkit.org/253399@main
@webkit-early-warning-system webkit-early-warning-system force-pushed the eng/JSC32bit-ASSERTION-FAILED-initialBytes branch from d60c87c to 3866ba7 Compare August 13, 2022 02:45
@webkit-commit-queue
Copy link
Collaborator

Committed 253399@main (3866ba7): https://commits.webkit.org/253399@main

Reviewed commits have been landed. Closing PR #3275 and removing active labels.

@webkit-early-warning-system webkit-early-warning-system merged commit 3866ba7 into WebKit:main Aug 13, 2022
@webkit-commit-queue webkit-commit-queue removed the merge-queue Applied to send a pull request to merge-queue label Aug 13, 2022
@mikhailramalho mikhailramalho deleted the eng/JSC32bit-ASSERTION-FAILED-initialBytes branch August 15, 2022 13:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
JavaScriptCore For bugs in JavaScriptCore, the JS engine used by WebKit, other than kxmlcore issues.
Projects
None yet
4 participants