uint8_t event_data[]; in system/lib/html5/callback.c is at offset 12 into the callback_args_t structure. So when the event data contains a double (such as EmscriptenWheelEvent), there will be a misaligned read in the callback. This aborts when SAFE_HEAP is enabled.
Version of emscripten/emsdk:
emcc (Emscripten gcc/clang-like replacement + linker emulating GNU ld) 6.0.4 (fe5be6a)
clang version 24.0.0git (https:/github.com/llvm/llvm-project c050c487e9edb97ef44f53cb29fe1d8bcddb8f76)
Target: wasm32-unknown-emscripten
Thread model: posix
Minimal reproducer
//
// Run with:
//
// emcc -O0 -pthread -sPTHREAD_POOL_SIZE=2 -sSAFE_HEAP=1 repro.c -o repro.js
// node repro.js
//
// On emcc 6.0.4 with SAFE_HEAP:
//
// Aborted(alignment fault)
//
#include <emscripten.h>
#include <emscripten/threading.h>
#include <emscripten/html5.h>
#include <pthread.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
// Internal API from system/lib/html5/emscripten_internal.h
typedef bool (*event_callback)(int event_type, void *event_data, void *user_data);
extern void _emscripten_run_callback_on_thread(pthread_t t,
event_callback f,
int event_type,
void *event_data,
size_t event_data_size,
void *user_data);
static volatile int g_done = 0;
static bool on_wheel(int event_type, void *event_data, void *user_data) {
const EmscriptenWheelEvent *e = (const EmscriptenWheelEvent *)event_data;
printf("%f %f %f\n", e->deltaX, e->deltaY, e->deltaZ);
g_done = 1;
return true;
}
static void *sender(void *arg) {
pthread_t target = (pthread_t)arg;
EmscriptenWheelEvent ev;
memset(&ev, 0, sizeof ev);
ev.deltaX = 1.0;
ev.deltaY = 2.0;
ev.deltaZ = 3.0;
_emscripten_run_callback_on_thread(target, on_wheel, EMSCRIPTEN_EVENT_WHEEL,
&ev, sizeof ev, NULL);
return NULL;
}
int main(void) {
pthread_t t;
pthread_create(&t, NULL, sender, (void *)pthread_self());
pthread_detach(t);
// Wait for delivery. "emscripten_thread_sleep" services the mailbox.
while (!g_done)
emscripten_thread_sleep(10);
return 0;
}
Output
$ emcc -O0 -pthread -sPTHREAD_POOL_SIZE=2 -sSAFE_HEAP=1 repro.c -o repro.js
$ node repro.js
Aborted(alignment fault)
uint8_t event_data[];insystem/lib/html5/callback.cis at offset 12 into thecallback_args_tstructure. So when the event data contains a double (such asEmscriptenWheelEvent), there will be a misaligned read in the callback. This aborts when SAFE_HEAP is enabled.Version of emscripten/emsdk:
emcc (Emscripten gcc/clang-like replacement + linker emulating GNU ld) 6.0.4 (fe5be6a)
clang version 24.0.0git (https:/github.com/llvm/llvm-project c050c487e9edb97ef44f53cb29fe1d8bcddb8f76)
Target: wasm32-unknown-emscripten
Thread model: posix
Minimal reproducer
Output