Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 06e92c10a5725ff226b8ba6a00cc428614d781a0
https://github.com/WebKit/WebKit/commit/06e92c10a5725ff226b8ba6a00cc428614d781a0
Author: Dan Hecht <dan.he...@apple.com>
Date: 2025-05-22 (Thu, 22 May 2025)
Changed paths:
A JSTests/wasm/gc/ref-i31-eq.js
M Source/JavaScriptCore/llint/InPlaceInterpreter64.asm
M Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp
Log Message:
-----------
[WASM GC] Fix BBQJIT::addRefI31 on constant expression
https://bugs.webkit.org/show_bug.cgi?id=293207
rdar://151653787
Reviewed by Yusuke Suzuki.
The constant evaluation path is constructing the final
i32.ref value incorrectly. The lhs of | is promoted to
signed 64-bits. So, when the constant had bit 30 set
(high bit of the i31), the sign was extended all the way
to 64 bits, rather than 32 bits.
This would not be noticible when doing i31.get_{u, s}
but is noticible when using the value as a ref, e.g. ref.eq.
Bonus: cleanup in InPlaceInterpreter64.asm is a no-op
but the value being pushed is the 64-bit ref, so use pushQuad().
Canonical link: https://commits.webkit.org/295271@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
