Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 9f07374e9eb2398ebf629352f5fc0a509ae631b8
https://github.com/WebKit/WebKit/commit/9f07374e9eb2398ebf629352f5fc0a509ae631b8
Author: Dan Hecht <[email protected]>
Date: 2026-08-23 (Sun, 23 Aug 2026)
Changed paths:
A JSTests/wasm/stress/omg-reduce-strength-select-exception-stackmap.js
M Source/JavaScriptCore/b3/B3ReduceStrength.cpp
M Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp
Log Message:
-----------
[JSC] Do not clone patchpoints for Wasm calls within a try block
rdar://178657225
https://bugs.webkit.org/show_bug.cgi?id=316791
Reviewed by Yijia Huang.
Similar to throw/rethrow patchpoints, a Wasm OMG call patchpoint inside
a Try block carries an exception-restoration stackmap keyed by its
CallSiteIndex,
so it should not be cloned. If B3 Select specialization (or B3DuplicateTails)
duplicates them, that leaves two call sites sharing one stackmap even with
potentially differing live-value layouts.
Extend 266643@main to also mark call patchpoints cloningForbidden when
m_tryCatchDepth != 0, and make specializeSelect() bail when a
cloning-forbidden value is in the range it would clone.
Test: JSTests/wasm/stress/omg-reduce-strength-select-exception-stackmap.js
Originally-landed-as: [email protected] (db24355101bd).
rdar://185368817
Canonical link: https://commits.webkit.org/319664@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
