Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 691f57b972ae3b96639412eccc5049b7a81e73b6
https://github.com/WebKit/WebKit/commit/691f57b972ae3b96639412eccc5049b7a81e73b6
Author: Sosuke Suzuki <[email protected]>
Date: 2026-10-12 (Mon, 12 Oct 2026)
Changed paths:
A JSTests/wasm/stress/bbq-i64-bitwise-op-with-blinded-constant.js
M Source/JavaScriptCore/assembler/MacroAssembler.h
Log Message:
-----------
[JSC] `and64`, `or64` and `xor64` with a blinded `Imm64` should read `src`
https://bugs.webkit.org/show_bug.cgi?id=327246
Reviewed by Yusuke Suzuki.
When the constant is blinded, MacroAssembler::and64(Imm64, src, dest), or64
and xor64 load it into the scratch register and emit op64(scratchRegister,
dest).
src is never read, so the result is computed from the old value of dest.
Only BBQ uses these forms, for i64.and, i64.or and i64.xor with a constant
operand. This was harmless while BBQ reused the operand's register for the
result. Since 323294@main, a local.get operand keeps its register, so src and
dest differ. Constants are blinded only on x86-64 and at random, which made
wasm/stress/pglite.js flaky.
This patch passes src to the three-register forms.
Test: JSTests/wasm/stress/bbq-i64-bitwise-op-with-blinded-constant.js
* JSTests/wasm/stress/bbq-i64-bitwise-op-with-blinded-constant.js: Added.
(constant):
* Source/JavaScriptCore/assembler/MacroAssembler.h:
(JSC::MacroAssembler::and64):
(JSC::MacroAssembler::xor64):
(JSC::MacroAssembler::or64):
Canonical link: https://commits.webkit.org/323522@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
