Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: f854abcc8468cc480403e228da57b42ccbbee009
https://github.com/WebKit/WebKit/commit/f854abcc8468cc480403e228da57b42ccbbee009
Author: Sergey Rubanov <[email protected]>
Date: 2026-07-14 (Tue, 14 Jul 2026)
Changed paths:
A JSTests/wasm/stress/bbq-const-fold-shift-mask.js
M Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
M Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp
Log Message:
-----------
[WASM] BBQ JIT omits mask before shr operation
https://bugs.webkit.org/show_bug.cgi?id=270257
Reviewed by Yusuke Suzuki.
When both operands of a shift are constants, BBQ folded with a raw C++
shift. Shift counts outside [0, 31] / [0, 63] are C++ undefined behavior,
so BBQ could disagree with OMG/IPInt (e.g. 0x7fffffff >> 536870909
produced 0 in BBQ vs 3 elsewhere). WebAssembly defines shift amounts
modulo the bit width; B3 already masks when folding.
Mask constant shift counts in BBQ folding: i32 & 31, i64 & 63.
* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:
(BBQJIT::addI32Shl):
(BBQJIT::addI32ShrS):
(BBQJIT::addI32ShrU):
* Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp:
(BBQJIT::addI64Shl):
(BBQJIT::addI64ShrS):
(BBQJIT::addI64ShrU):
* JSTests/wasm/stress/bbq-const-fold-shift-mask.js: Added. Covers the bug
PoC (i32) and an i64 analog.
Canonical link: https://commits.webkit.org/317190@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
