Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8c7d5cdee6369ebb6b6f8e502ce16836737f73ca
https://github.com/WebKit/WebKit/commit/8c7d5cdee6369ebb6b6f8e502ce16836737f73ca
Author: Cole Carley <[email protected]>
Date: 2026-07-24 (Fri, 24 Jul 2026)
Changed paths:
M
LayoutTests/imported/w3c/web-platform-tests/wasm/core/bulk-memory/table_init.wast.js-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/wasm/core/gc/array_init_elem.wast.js-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/wasm/core/gc/array_new_elem.wast.js-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/table_init64.wast.js-expected.txt
M Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp
M Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h
Log Message:
-----------
Evaluate element segment expressions exactly once per instance
https://bugs.webkit.org/show_bug.cgi?id=320129
rdar://183067192
Reviewed by Marcus Plutowski.
Per the Wasm spec, an element segment's element expressions are evaluated
exactly once during module instantiation, and the resulting references are
stored in the element instance. Then, table.init and array.new_elem only copy
those already-evaluated references.
JSC instead re-evaluated the constant expression on every read of an element
segment (in initElementSegment and copyElementSegment). For reference-producing
GC expressions such as array.new_default, each evaluation allocates a fresh
object, so two table.init operations from the same passive segment produced
distinct arrays and ref.eq returned 0 instead of 1. This surfaced as a failure
in imported/w3c/web-platform-tests/wasm/core/memory64/table_init64.wast.js
(test #1044).
Evaluate each element-segment expression exactly once per instance by caching
the result in m_constantExpressionValues, and mark the cached references
during GC visitation.
*
LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/table_init64.wast.js-expected.txt:
* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp:
(JSC::JSWebAssemblyInstance::visitChildrenImpl):
(JSC::JSWebAssemblyInstance::initElementSegment):
(JSC::JSWebAssemblyInstance::copyElementSegment):
(JSC::JSWebAssemblyInstance::ensureConstantExpressionValue):
* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h:
Canonical link: https://commits.webkit.org/317904@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
