Recover only nonfatal LTSM exceptions

Author: highesttt

pkg/ltsm/embind.go

@@ -151,11 +151,6 @@ type Imports struct {
 	classByName map[string]*ClassInfo
 	emval       *EmvalTable
 
-	// dead is set when a WASM call hits a fatal path (_abort, C++ throw,
-	// EM_JS throw) that cannot be recovered. Later calls return deadErr.
-	dead    bool
-	deadErr error
-
 	// File descriptor state for /dev/urandom emulation
 	urandomFD uint32
 	nextFD    uint32
@@ -177,26 +172,18 @@ func (imp *Imports) SetModule(m *Module) {
 	imp.mod = m
 }
 
-// markDead records a fatal WASM error so subsequent calls fail fast.
-// The first fatal error is retained.
-func (imp *Imports) markDead(v any) {
-	if imp.dead {
-		return
-	}
-	imp.dead = true
-	if err, ok := v.(error); ok {
-		imp.deadErr = err
-	} else {
-		imp.deadErr = fmt.Errorf("%v", v)
-	}
-}
+// wasmException marks a normal exception reported by the embedded module.
+type wasmException string
 
-// checkDead is the defer target for functions that dispatch into the WASM
-// module: a fatal panic is converted to the dead-runtime error.
-func (imp *Imports) checkDead(err *error) {
+// recoverError converts ordinary WASM exceptions to errors. An abort or
+// unexpected panic may leave the runtime unusable, so propagate it.
+func recoverError(err *error) {
 	if v := recover(); v != nil {
-		imp.markDead(v)
-		*err = imp.deadErr
+		if exception, ok := v.(wasmException); ok {
+			*err = errors.New(string(exception))
+			return
+		}
+		panic(v)
 	}
 }
 
@@ -523,7 +510,7 @@ func (imp *Imports) Import_o(p0, p1, p2 uint32) uint32 { // EM_JS dispatcher
 		if len(args) >= 2 {
 			errMsg = imp.readCStr(args[1])
 		}
-		panic(fmt.Sprintf("ltsm: EM_JS error: %s: %s", errType, errMsg))
+		panic(wasmException(fmt.Sprintf("ltsm: EM_JS error: %s: %s", errType, errMsg)))
 
 	case 1456985: // init getRandomValues
 		return 0
@@ -713,7 +700,7 @@ func (imp *Imports) Import_A(p0, p1 uint32) uint32 { // _emval_get_property
 }
 
 func (imp *Imports) Import_B(p0, p1, p2 uint32) { // __cxa_throw
-	panic(fmt.Sprintf("ltsm: C++ exception thrown (type=%d, ptr=%d)", p1, p0))
+	panic(wasmException(fmt.Sprintf("ltsm: C++ exception thrown (type=%d, ptr=%d)", p1, p0)))
 }
 
 func (imp *Imports) Import_C(p0 uint32) uint32 { // emscripten_resize_heap
@@ -866,9 +853,6 @@ func toFloat64(v any) float64 {
 
 // CallMethod calls an embind instance method on a C++ object.
 func (imp *Imports) CallMethod(className, methodName string, thisPtr uint32, args ...uint32) (uint32, error) {
-	if imp.dead {
-		return 0, imp.deadErr
-	}
 	ci := imp.classByName[className]
 	if ci == nil {
 		return 0, fmt.Errorf("ltsm: class %q not found", className)
@@ -897,9 +881,6 @@ func (imp *Imports) CallMethod(className, methodName string, thisPtr uint32, arg
 
 // CallStatic calls an embind static method.
 func (imp *Imports) CallStatic(className, methodName string, args ...uint32) (uint32, error) {
-	if imp.dead {
-		return 0, imp.deadErr
-	}
 	ci := imp.classByName[className]
 	if ci == nil {
 		return 0, fmt.Errorf("ltsm: class %q not found", className)
@@ -920,9 +901,6 @@ func (imp *Imports) CallStatic(className, methodName string, args ...uint32) (ui
 
 // Construct calls an embind class constructor.
 func (imp *Imports) Construct(className string, args ...uint32) (uint32, error) {
-	if imp.dead {
-		return 0, imp.deadErr
-	}
 	ci := imp.classByName[className]
 	if ci == nil {
 		return 0, fmt.Errorf("ltsm: class %q not found", className)
@@ -943,10 +921,7 @@ func (imp *Imports) Construct(className string, args ...uint32) (uint32, error)
 
 // Destroy invokes the registered C++ destructor for an embind object.
 func (imp *Imports) Destroy(className string, ptr uint32) (err error) {
-	defer imp.checkDead(&err)
-	if imp.dead {
-		return imp.deadErr
-	}
+	defer recoverError(&err)
 	if ptr == 0 {
 		return nil
 	}
@@ -989,7 +964,7 @@ func (imp *Imports) MarkSecureKeyExportable(ptr uint32) {
 // callIndirect dispatches to the appropriate callIndirectTN based on parameter count and types.
 // Most embind methods use all-uint32 params, but some have uint64 (bigint) params or returns.
 func (imp *Imports) callIndirect(invokerIdx uint32, argTypes []uint32, callArgs []uint32) (ret uint32, err error) {
-	defer imp.checkDead(&err)
+	defer recoverError(&err)
 	m := imp.mod
 	nArgs := len(callArgs)
 

pkg/ltsm/embind_test.go

@@ -4,6 +4,7 @@ import (
 	"crypto/sha256"
 	"encoding/base64"
 	"errors"
+	"strings"
 	"testing"
 )
 
@@ -467,39 +468,78 @@ func TestCurve25519KeyGenerate(t *testing.T) {
 	}
 }
 
-func TestCallIndirectConvertsPanicToError(t *testing.T) {
+func TestUnexpectedDispatchPanicIsFatal(t *testing.T) {
 	_, imp := initModule(t)
+	defer func() {
+		if recover() == nil {
+			t.Fatal("unexpected dispatch panic was swallowed")
+		}
+	}()
+	_, _ = imp.callIndirect(0, nil, nil)
+}
+
+func TestAbortRemainsFatal(t *testing.T) {
+	var err error
+	defer func() {
+		recovered := recover()
+		fatal, ok := recovered.(error)
+		if !ok || !errors.Is(fatal, ErrAbort) || err != nil {
+			t.Fatalf("abort was swallowed: recovered=%v, err=%v", recovered, err)
+		}
+	}()
+	func() {
+		defer recoverError(&err)
+		panic(ErrAbort)
+	}()
+}
 
-	// A nil argTypes slice panics inside the dispatch; the fatal panic must
-	// be converted to an error and mark the runtime dead.
-	ret, err := imp.callIndirect(0, nil, nil)
-	if ret != 0 {
-		t.Fatalf("ret = %d, want 0", ret)
+func TestV1FallbackAfterOrdinaryV2DecryptError(t *testing.T) {
+	rt, err := NewRuntime()
+	if err != nil {
+		t.Fatal(err)
 	}
-	if err == nil {
-		t.Fatal("expected error from recovered panic")
+	senderKey, err := rt.Curve25519KeyGenerate()
+	if err != nil {
+		t.Fatal(err)
 	}
-	if !imp.dead {
-		t.Fatal("runtime not marked dead after recovered panic")
+	receiverKey, err := rt.Curve25519KeyGenerate()
+	if err != nil {
+		t.Fatal(err)
 	}
-}
-
-func TestDeadRuntimeFailsFast(t *testing.T) {
-	_, imp := initModule(t)
-
-	imp.markDead(ErrAbort)
-	imp.markDead("second fatal error") // first fatal error wins
-
-	if _, err := imp.CallMethod("SecureKey", "loadToken", 0); !errors.Is(err, ErrAbort) {
-		t.Fatalf("CallMethod on dead runtime: %v", err)
+	senderPub, err := rt.Curve25519KeyGetPublicKey(senderKey)
+	if err != nil {
+		t.Fatal(err)
 	}
-	if _, err := imp.CallStatic("SecureKey", "loadToken", 0); !errors.Is(err, ErrAbort) {
-		t.Fatalf("CallStatic on dead runtime: %v", err)
+	receiverPub, err := rt.Curve25519KeyGetPublicKey(receiverKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	senderChannel, err := rt.Curve25519KeyCreateChannel(senderKey, receiverPub)
+	if err != nil {
+		t.Fatal(err)
 	}
-	if _, err := imp.Construct("Hmac"); !errors.Is(err, ErrAbort) {
-		t.Fatalf("Construct on dead runtime: %v", err)
+	receiverChannel, err := rt.Curve25519KeyCreateChannel(receiverKey, senderPub)
+	if err != nil {
+		t.Fatal(err)
 	}
-	if err := imp.Destroy("SecureKey", 1); !errors.Is(err, ErrAbort) {
-		t.Fatalf("Destroy on dead runtime: %v", err)
+	plaintext := []byte("iOS V1 message")
+	ciphertext, err := rt.E2EEChannelEncryptV1(senderChannel, plaintext)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := rt.E2EEChannelDecryptV2(receiverChannel, "to", "from", 1, 2, 0, ciphertext); err == nil || !strings.Contains(err.Error(), "C++ exception thrown") {
+		t.Fatalf("V2 error = %v, want ordinary C++ exception", err)
+	}
+	tampered := append([]byte(nil), ciphertext...)
+	tampered[len(tampered)-1] ^= 1
+	if _, err := rt.E2EEChannelDecryptV1(receiverChannel, tampered); err == nil || !strings.Contains(err.Error(), "EM_JS error") {
+		t.Fatalf("tampered V1 error = %v, want ordinary EM_JS exception", err)
+	}
+	decrypted, err := rt.E2EEChannelDecryptV1(receiverChannel, ciphertext)
+	if err != nil {
+		t.Fatalf("V1 fallback failed: %v", err)
+	}
+	if string(decrypted) != string(plaintext) {
+		t.Fatalf("V1 fallback = %q, want %q", decrypted, plaintext)
 	}
 }

pkg/ltsm/runtime.go

@@ -21,25 +21,10 @@ func NewRuntime() (*Runtime, error) {
 	mod := NewModule(imp)
 	imp.SetModule(mod)
 
-	var initErr error
-	func() {
-		defer func() {
-			if v := recover(); v != nil {
-				if err, ok := v.(error); ok {
-					initErr = err
-				} else {
-					initErr = fmt.Errorf("%v", v)
-				}
-			}
-		}()
-		// Phase 1: __wasm_call_ctors
-		mod.fP()
-		// Phase 2: embind type/class registrations
-		mod.fT()
-	}()
-	if initErr != nil {
-		return nil, fmt.Errorf("ltsm: runtime init failed: %w", initErr)
-	}
+	// Phase 1: __wasm_call_ctors
+	mod.fP()
+	// Phase 2: embind type/class registrations
+	mod.fT()
 
 	return &Runtime{mod: mod, imp: imp}, nil
 }
@@ -49,12 +34,6 @@ func (rt *Runtime) ModuleMem() []byte {
 	return rt.mod.mem
 }
 
-// Dead reports whether the runtime suffered a fatal WASM error.
-func (rt *Runtime) Dead() bool { return rt.imp.dead }
-
-// DeadError returns the fatal error that stopped the runtime, if any.
-func (rt *Runtime) DeadError() error { return rt.imp.deadErr }
-
 // Close releases resources. No-op for the transpiled module.
 func (rt *Runtime) Close() {}