binaryen icon indicating copy to clipboard operation
binaryen copied to clipboard

In I64ToI32Lowering pass, lowerReinterpretFloat64() and lowerReinterpretInt64() are not multithreading, ASAN, STACK_OVERLOW_CHECK or SAFE_HEAP safe

Open juj opened this issue 3 years ago • 0 comments

In https://github.com/WebAssembly/binaryen/blob/fc00dcc64c337a8128fbf2b5fbdb40bb0aaa861b/src/passes/I64ToI32Lowering.cpp#L548-L584

there are assumptions made that are unsafe for multithreaded Wasm2JS builds. The memory address zero could be trashed by other threads when they are reinterpreted as float64/int64.

Also the Emscripten STACK_OVERFLOW_CHECK, ASAN and SAFE_HEAP checks place a cookie at address 0.

juj avatar Jun 02 '22 13:06 juj