Fix crash in UTF8ToString with resizable ArrayBuffers by heyparth1 · Pull Request #27242 · emscripten-core/emscripten

heyparth1 · 2026-07-02T13:43:24Z

This fixes a crash in UTF8ToString (and related functions) that occurs when the heap is backed by a resizable ArrayBuffer. The TextDecoder.decode() API throws a TypeError when passed a view of a resizable ArrayBuffer, which previously caused a crash in builds with ALLOW_MEMORY_GROWTH and GROWABLE_ARRAYBUFFERS enabled.

The getUnsharedTextDecoderView function in src/parseTools.mjs is updated to detect when the heap might be resizable and generate code that copies the data using .slice() if the buffer is resizable, ensuring TextDecoder only receives non-resizable views. A test is added to verify this behavior by emulating the browser's strict TextDecoder implementation.

Closes #27241

sbc100

@guybedford this is the kind of thing you warned me about in our last meeting I think.

The fix does seems reasonable. I do wonder if its worth reverting the GROWABLE_ARRAYBUFFERS defaulting to 1 change (#27212) though (in addition to landing this change).

…rayBuffers getUnsharedTextDecoderView now copies data when the heap buffer is resizable (GROWABLE_ARRAYBUFFERS), and the GROWABLE_ARRAYBUFFERS default is reverted to 0 (as in the upstream 6.0.3 fix), so TextDecoder.decode() no longer rejects the view.

guybedford

This makes sense. In the mean time I'd encourage anyone interested in this space to tackle the spec changes to add resizable support to APIs. There's no technical reason not to support resizable buffers short of doing the spec and implementer reach out with regards to ensuring the right security review.

kleisauke

It looks like you're committing with heyparth@Dhruvs-MacBook-Air.local as your email address. Was that intentional?

(LLVM has a policy on this though I'm not sure whether the same applies to Emscripten)

Split out from emscripten-core#27242. See: emscripten-core#27241

Split out from #27242. See: #27241

sbc100 · 2026-07-07T16:46:08Z

@heyparth1 do you have time to look at this today? I'd love to get this fix into a new release ASAP.

heyparth1 · 2026-07-07T21:42:40Z

Done — the GROWABLE_ARRAYBUFFERS default is reverted to 0 (with a ChangeLog entry; the decode fix stays so the setting still works when enabled explicitly), the settings reference docs are regenerated for build-docs, and I rebaselined the three memory-growth codesize expectations the revert affected. The test-stress failure was just an npm ci network error during bootstrap (the suite passes locally), so a re-run should clear it — note the codesize check also flags a pre-existing staleness on main from the minimum_runtime_check.js comment change, which needs the rebaseline action on the main branch rather than this PR. Good catch on the commit email — I'll make sure subsequent commits use my proper address.

sbc100 · 2026-07-07T21:50:47Z

+      int main() {
+        // Long enough (> 16 bytes) that UTF8ToString on the script string
+        // takes the TextDecoder path.
+        emscripten_run_script("out('the quick brown fox jumps over the lazy dog')");


Can you just use emscripten_out here rather then emscripten_run_script.

heyparth1 · 2026-07-08T06:39:06Z

Done — switched the test to call emscripten_out() directly (with emscripten/console.h) instead of going through emscripten_run_script. It exercises the same UTF8ToString path, and I re-verified both test variants still fail without the fix and pass with it.

sbc100 · 2026-07-08T16:28:01Z

 This settings does nothing unless ALLOW_MEMORY_GROWTH is set.

-Default value: 1
+Default value: 0


This change already landed on main in #27260 so I guess you need to rebase or merge?

sbc100

Can you rebase or merge with the main branch and rebase the codesize changes?

sbc100 · 2026-07-09T19:13:06Z

Do you mind if I push an update to this PR, since it would be good to get it into the next release?

# Conflicts: # test/codesize/test_codesize_mem_O3_grow.json # test/codesize/test_codesize_mem_O3_grow_standalone.json # test/codesize/test_codesize_minimal_pthreads_memgrowth.json

sbc100 · 2026-07-09T20:08:47Z

It looks like you're committing with heyparth@Dhruvs-MacBook-Air.local as your email address. Was that intentional?

(LLVM has a policy on this though I'm not sure whether the same applies to Emscripten)

Hmm.. interesting point yes. I think it would be good to have a valid email address yes, although of course we have not way to verify it.

@heyparth1 what email would you like associated with this commit? (Perhaps you should setup your git config with an actual email address?)

heyparth1 · 2026-07-10T08:38:46Z

Please go ahead and push an update / rebase — I'd love to see this in the next release too. The codesize expectations on the branch are freshly regenerated against the current sources (the three memory-growth files; the other drift the check flagged comes from main and should resolve once main is rebaselined). And apologies for the odd address — please use dhruvsharma52866@gmail.com for the commit; I've fixed my git config so it's used going forward.

sbc100 · 2026-07-10T16:11:11Z

Pushed a new version of the branch with email address updated.

Crash in emsdk 6.0.2 when calling UTF8ToString

890dc82

sbc100 reviewed Jul 2, 2026

View reviewed changes

Address review feedback

9e20536

pavelsavara mentioned this pull request Jul 3, 2026

bump emscripten to 6.0.2 dotnet/emscripten#259

Merged

guybedford approved these changes Jul 3, 2026

View reviewed changes

sbc100 reviewed Jul 3, 2026

View reviewed changes

Comment thread src/settings.js

kleisauke reviewed Jul 4, 2026

View reviewed changes

Comment thread src/parseTools.mjs Outdated

Comment thread src/parseTools.mjs Outdated

sbc100 mentioned this pull request Jul 6, 2026

JS exception/crash in emsdk 6.0.2 when calling UTF8ToString #27241

Closed

sbc100 added a commit to sbc100/emscripten that referenced this pull request Jul 6, 2026

Revert default for GROWABLE_ARRAYBUFFERS to 0

a87d837

Split out from emscripten-core#27242. See: emscripten-core#27241

sbc100 mentioned this pull request Jul 6, 2026

Revert default for GROWABLE_ARRAYBUFFERS to 0 #27260

Merged

sbc100 added a commit to sbc100/emscripten that referenced this pull request Jul 6, 2026

Revert default for GROWABLE_ARRAYBUFFERS to 0

44b0b66

Split out from emscripten-core#27242. See: emscripten-core#27241

sbc100 added a commit to sbc100/emscripten that referenced this pull request Jul 6, 2026

Revert default for GROWABLE_ARRAYBUFFERS to 0

6dca87d

Split out from emscripten-core#27242. See: emscripten-core#27241

sbc100 added a commit to sbc100/emscripten that referenced this pull request Jul 6, 2026

Revert default for GROWABLE_ARRAYBUFFERS to 0

c6c1999

Split out from emscripten-core#27242. See: emscripten-core#27241

sbc100 added a commit that referenced this pull request Jul 6, 2026

Revert default for GROWABLE_ARRAYBUFFERS to 0 (#27260)

cd9990f

Split out from #27242. See: #27241

Address review feedback

216a8ea

sbc100 reviewed Jul 7, 2026

View reviewed changes

Address review feedback

5d96b06

sbc100 reviewed Jul 8, 2026

View reviewed changes

sbc100 added 5 commits July 9, 2026 12:14

Merge remote-tracking branch 'upstream/main' into brutus/issue-27241

5ae4199

# Conflicts: # test/codesize/test_codesize_mem_O3_grow.json # test/codesize/test_codesize_mem_O3_grow_standalone.json # test/codesize/test_codesize_minimal_pthreads_memgrowth.json

Restore package-lock.json

0273f38

rebase

0490b5b

update changelog

00cd3ed

feedback

a634c79

sbc100 requested a review from kleisauke July 9, 2026 19:38

kleisauke approved these changes Jul 10, 2026

View reviewed changes

sbc100 force-pushed the brutus/issue-27241 branch from 596e589 to a634c79 Compare July 10, 2026 16:10

sbc100 enabled auto-merge (squash) July 10, 2026 16:11

Merge remote-tracking branch 'upstream/main' into brutus/issue-27241

5fbde14

sbc100 disabled auto-merge July 10, 2026 21:20

sbc100 merged commit a41c221 into emscripten-core:main Jul 10, 2026
19 of 21 checks passed

Uh oh!

Conversation

heyparth1 commented Jul 2, 2026

Uh oh!

sbc100 left a comment

Choose a reason for hiding this comment

Uh oh!

guybedford left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kleisauke left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

sbc100 commented Jul 7, 2026

Uh oh!

heyparth1 commented Jul 7, 2026

Uh oh!

sbc100 Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

heyparth1 commented Jul 8, 2026

Uh oh!

sbc100 Jul 8, 2026

Choose a reason for hiding this comment

Uh oh!

sbc100 left a comment

Choose a reason for hiding this comment

Uh oh!

sbc100 commented Jul 9, 2026

Uh oh!

sbc100 commented Jul 9, 2026

Uh oh!

heyparth1 commented Jul 10, 2026

Uh oh!

sbc100 commented Jul 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants