Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 5df8b0b81bf5a7ca7513fb5b61fcaf64e936dae0
https://github.com/WebKit/WebKit/commit/5df8b0b81bf5a7ca7513fb5b61fcaf64e936dae0
Author: Anand Srinivasan <[email protected]>
Date: 2026-07-01 (Wed, 01 Jul 2026)
Changed paths:
A JSTests/wasm/stress/br-on-cast-reserved-flags.js
M Source/JavaScriptCore/wasm/WasmFunctionParser.h
Log Message:
-----------
WasmGC should reject reserved bits in br_on_cast/br_on_cast_fail flags byte
https://bugs.webkit.org/show_bug.cgi?id=315223
rdar://176190526
Reviewed by Dan Hecht.
In br_on_cast and br_on_cast_fail flag bits other than 0 and 1 are
reserved. The validator currently does not check that reserved bits are
0 and IPInt assumes reserved bits are 0. This patch makes the validator
check the reserved bits.
Test: JSTests/wasm/stress/br-on-cast-reserved-flags.js
* JSTests/wasm/stress/br-on-cast-reserved-flags.js: Added.
* Source/JavaScriptCore/wasm/WasmFunctionParser.h:
(JSC::Wasm::FunctionParser<Context>::parseExpression):
(JSC::Wasm::FunctionParser<Context>::parseUnreachableExpression):
Originally-landed-as: 305413.945@safari-7624-branch (6d5ae0fc9aa1).
rdar://180437388
Canonical link: https://commits.webkit.org/316266@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
