Safari (17.5 -> 18.0.1): "Out of bounds memory access" and "RangeError: Bad value"

[bes]

Hello! I have a wasm library bundled with a TypeScript SPA through Webpack, and errors are sent to Sentry.

I have a large sample size of users (20k+ daily) and a small percentage of them are hitting "Out of bounds memory access", but only on recent versions of Safari. About 100 Safari users are getting "Out of bounds memory access" and "RangeError: Bad value" originating somewhere in WebAssembly.

Once one of the errors hit one method, all of them start throwing these errors.

I know this is a bit vague, but I want to gauge the community's feeling for what this might be.

• Is this just a Safari thing, or is it something I am doing wrong?
• What are your best ideas for debugging / reproducing this? (I haven't been able to reproduce it yet)

Zero errors from non-WebKit browsers in Sentry over a period of 90 days.

[daxpedda]

See #3698, I hope a stacktrace can be a good start.
There are also tools for coredumping, though I'm unsure how up-to-date they are now.

[Liamolucko]

This sounds similar to #3474; we never managed to solve that though, so it isn't of much help.

[bes]

I can't be sure, but it seems like RangeError: Bad Value always happens before Out of bounds memory access and that it happens here:

export function __wbindgen_string_new(arg0, arg1) {
    const ret = getStringFromWasm0(arg0, arg1);
    return addHeapObject(ret);
};

So something inside the wasm blob calls__wbindgen_string_new in javascript, which crashes here, according to Sentry (but I can't know if it's 100% correct):

function getStringFromWasm0(ptr, len) {
    ptr = ptr >>> 0;
    return cachedTextDecoder.decode(getUint8ArrayMemory0().subarray(ptr, ptr + len));
}

It doesn't show where it crashes inside getStringFromWasm0, it just looks like this:

[daxpedda]

Well, that's a good start! But its going to be quite hard without a reproduction or a stacktrace.

But presumably some invalid string is trying to be created, which is strange as its simply passing the pointer and length. Knowing where exactly this happens could help you debug it, e.g. you could simply print the pointer and length and compare it to a memory snapshot (not sure if Sentry sends this along as well).

Is your application by any chance consuming 2 GB or more? Maybe there is some issue in Safari around that.

[stephanemagnenat]

I have no idea whether my input is helpful, but with a Rustc that has multivalue and reference-types enabled by default (>= 1.82), I'm getting RuntimeError: Out of bounds table access (evaluating 't.crop_and_call(e,n,_)') where crop_and_call is an exported Rust function. I am getting this error in a web worker on Safari <= 16.3. My work-around has been to downgrade Rustc to 1.81, hopefully it solves the issue. It is hard to debug as this is optimized image-processing code running in production.

[bes]

This is another issue. Another way to solve this is to set strip = true in Cargo.toml under [profile.release] with a newer compiler. I don't know why, and it might not be a reliable workaround, but it works for now.