dmaax/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
79641 commits 1 branch 0 tags 366 MiB
Commit graph

8 commits

Author SHA1 Message Date
sideshowbarker
59eb221d7c LibWasm: Fix “return” leaking intermediate value-stack entries to caller 
Problem: Loading WebAssembly modules that use “return” mid-function can
corrupt the heap and crash the browser.

Cause: HANDLE_INSTRUCTION(return_) shrank the label stack but left any
working values pushed before the “return” instruction on the shared
value stack. Those residuals leaked into the caller’s frame and
accumulated across calls — until they overflowed the value stack’s
inline storage and corrupted adjacent allocator metadata.

Fix: After shrinking the label stack down to the function-level label,
also remove value-stack entries between that label’s recorded
stack_height and the top .arity() result values — mirroring the cleanup
that branch_to_label<true> already performs for br/br_if.

Fixes https://github.com/LadybirdBrowser/ladybird/issues/9614
 2026-05-25 09:00:44 +02:00
Ali Mohammad Pur
96c3a5ed73 LibWasm: Add a regression test for cross-module memory access 
This is not well-covered in neither the spectests nor our own tests.
 2026-05-10 16:41:42 +02:00
Ali Mohammad Pur
0e7fb1386e LibWasm: Use the right indices for i64 constlocal fused ops 
Also aligns the i32 ones to use the same detection logic as the i64
cases.
 2026-02-23 00:22:47 +01:00
Timothy Flynn
019c529c07 Meta: Increase the line length enforced by prettier to 120 
This matches our coding style recommendation in CodingStyle.md, and
matches our python formatting.
 2025-10-31 19:55:50 -04:00
Ali Mohammad Pur
31da9ab4e8 LibWasm: Take memory_fill arguments in the right order 
This makes ruffle.rs work again :^)
 2025-10-04 11:17:08 +02:00
Pavel Shliak
a125bc97c4 LibWasm: Fix memory.fill ignoring memory index and unsafe bounds check 
Previously, the memory.fill instruction always wrote to memory 0,
ignoring the selected memory index. This caused incorrect behavior
in multi-memory modules (e.g. filling mem0 instead of mem1).
Additionally, the bounds check used `destination_offset + count`
without overflow checking, which could wrap and bypass validation.

This patch:
- Passes `args.memory_index` into store_to_memory, so the correct
  memory is filled.
- Uses Checked<u32> for destination_offset + count, consistent
  with memory.copy and memory.init, to prevent overflow.

Minimal repro:

    (module
      (memory $m0 1)
      (memory $m1 1)

      (func (export "go") (result i32)
        ;; Fill mem1[0] with 0xAA
        i32.const 0
        i32.const 170
        i32.const 1
        memory.fill (memory 1)

        ;; Return (mem1[0] << 8) | mem0[0]
        i32.const 0
        i32.load8_u (memory 1)
        i32.const 8
        i32.shl
        i32.const 0
        i32.load8_u (memory 0)
        i32.or
      )
    )

Before fix: returns 170 (0x00AA).
After fix:  returns 43520 (0xAA00).
 2025-09-06 08:51:11 +02:00
Luke Wilde
12dc771186 CI: Create wasm artifact and use it in the js-benchmarks workflow 2025-08-14 10:02:35 +02:00
Timothy Flynn
93712b24bf Everywhere: Hoist the Libraries folder to the top-level 2024-11-10 12:50:45 +01:00