| e5b127cc | 02-Apr-2026 |
Nick Fitzgerald <[email protected]> |
Add missing stack map declaration for `array.new_elem` (#12936)
`translate_array_new_elem` created a GC reference (array ref) via a libcall but
did not call `builder.declare_value_needs_stack_map()`
Add missing stack map declaration for `array.new_elem` (#12936)
`translate_array_new_elem` created a GC reference (array ref) via a libcall but
did not call `builder.declare_value_needs_stack_map()` on the result. This meant
the reference was not included in stack maps at subsequent safepoints, so if a
GC occurred, the reference became stale (leading to use-after-free within the GC
heap sandbox).
show more ...
|
| 0d66dffd | 02-Apr-2026 |
Nick Fitzgerald <[email protected]> |
Add missing missing stack map declaration for `array.new_data` (#12935)
`translate_array_new_data` created a GC reference (array ref) via a libcall but
did not call `builder.declare_value_needs_stac
Add missing missing stack map declaration for `array.new_data` (#12935)
`translate_array_new_data` created a GC reference (array ref) via a libcall but
did not call `builder.declare_value_needs_stack_map()` on the result. This meant
that the reference was not included in stack maps at subsequent safepoints, so
if a GC occurred, the reference became stale (leading to use-after-free bugs
inside the GC heap sandbox).
show more ...
|
| 956ca003 | 12-Mar-2025 |
Nick Fitzgerald <[email protected]> |
`AnyRef::from_raw` needs to clone its GC ref (#10374)
Like `ExternRef::from_raw` does.
This is because while `to_raw` clones the GC ref, it also exposes it to Wasm,
inserting it into the DRC collec
`AnyRef::from_raw` needs to clone its GC ref (#10374)
Like `ExternRef::from_raw` does.
This is because while `to_raw` clones the GC ref, it also exposes it to Wasm,
inserting it into the DRC collector's table, which effectively gives ownership
of that clone to Wasm. Then, if we don't clone in `from_raw`, when a GC is
triggered, the DRC collector will see that Wasm isn't holding the ref alive
anymore and will decref (and perhaps even deallocate) it, which leaves the
`AnyRef` we constructed via `from_raw` dangling.
Fixes #10182
show more ...
|
| 0038ce0a | 11-Mar-2025 |
Nick Fitzgerald <[email protected]> |
Perform `(ref null none)` loads that can trap (#10372)
As an optimization, we were previously avoiding the load and instead simply
materializing the null reference value, since that is the only valu
Perform `(ref null none)` loads that can trap (#10372)
As an optimization, we were previously avoiding the load and instead simply
materializing the null reference value, since that is the only value that
inhabits `(ref null none)`. However, in certain situations, such as when loading
from a table when Spectre mitigations are enabled, we rely on that load being
attempted and resulting in a trap if the table index is out of bounds. This
commit makes it so that we will always perform the load if our given
`ir::MemFlags` can trap.
Fixes #10353
show more ...
|