Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6decd847ff1762e7bc2a269e3a264192ed704c24
https://github.com/WebKit/WebKit/commit/6decd847ff1762e7bc2a269e3a264192ed704c24
Author: Asumu Takikawa <as...@igalia.com>
Date: 2024-01-11 (Thu, 11 Jan 2024)
Changed paths:
A JSTests/wasm/gc/bug267381.js
M Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
Log Message:
-----------
[Wasm-GC] Fix write barrier bug in BBQ array.set
https://bugs.webkit.org/show_bug.cgi?id=267381
Reviewed by Justin Michaud.
Fixes a bug in the patch for bug245405. The write barriers in these cases were
in the right place, but the condition to check for them was wrong (because BBQ
values use I64 type kind for Ref types). The condition now uses the type index
to look up the type.
* JSTests/wasm/gc/bug267381.js: Added.
(i.assert.eq.m2.exports):
* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:
(JSC::Wasm::BBQJIT::addArrayNewFixed):
(JSC::Wasm::BBQJIT::addArraySet):
Canonical link: https://commits.webkit.org/272923@main
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
