Skip to content

event_data does not have suitable alignment (SAFE_HEAP abort) #27447

Description

@paradust7

uint8_t event_data[]; in system/lib/html5/callback.c is at offset 12 into the callback_args_t structure. So when the event data contains a double (such as EmscriptenWheelEvent), there will be a misaligned read in the callback. This aborts when SAFE_HEAP is enabled.

Version of emscripten/emsdk:
emcc (Emscripten gcc/clang-like replacement + linker emulating GNU ld) 6.0.4 (fe5be6a)
clang version 24.0.0git (https:/github.com/llvm/llvm-project c050c487e9edb97ef44f53cb29fe1d8bcddb8f76)
Target: wasm32-unknown-emscripten
Thread model: posix

Minimal reproducer

//
// Run with:
//
//   emcc -O0 -pthread -sPTHREAD_POOL_SIZE=2 -sSAFE_HEAP=1 repro.c -o repro.js
//   node repro.js
//
// On emcc 6.0.4 with SAFE_HEAP:
//
//   Aborted(alignment fault)
//

#include <emscripten.h>
#include <emscripten/threading.h>
#include <emscripten/html5.h>
#include <pthread.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

// Internal API from system/lib/html5/emscripten_internal.h
typedef bool (*event_callback)(int event_type, void *event_data, void *user_data);
extern void _emscripten_run_callback_on_thread(pthread_t t,
                                               event_callback f,
                                               int event_type,
                                               void *event_data,
                                               size_t event_data_size,
                                               void *user_data);

static volatile int g_done = 0;

static bool on_wheel(int event_type, void *event_data, void *user_data) {
  const EmscriptenWheelEvent *e = (const EmscriptenWheelEvent *)event_data;
  printf("%f %f %f\n", e->deltaX, e->deltaY, e->deltaZ);
  g_done = 1;
  return true;
}

static void *sender(void *arg) {
  pthread_t target = (pthread_t)arg;
  EmscriptenWheelEvent ev;
  memset(&ev, 0, sizeof ev);
  ev.deltaX = 1.0;
  ev.deltaY = 2.0;
  ev.deltaZ = 3.0;
  _emscripten_run_callback_on_thread(target, on_wheel, EMSCRIPTEN_EVENT_WHEEL,
                                     &ev, sizeof ev, NULL);
  return NULL;
}

int main(void) {
  pthread_t t;
  pthread_create(&t, NULL, sender, (void *)pthread_self());
  pthread_detach(t);

  // Wait for delivery. "emscripten_thread_sleep" services the mailbox.
  while (!g_done)
    emscripten_thread_sleep(10);
  return 0;
}

Output

$ emcc -O0 -pthread -sPTHREAD_POOL_SIZE=2 -sSAFE_HEAP=1 repro.c -o repro.js
$ node repro.js
Aborted(alignment fault)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions