Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 9dcbd254af217b64f37947d680ce0c6eae0ab7e3
https://github.com/WebKit/WebKit/commit/9dcbd254af217b64f37947d680ce0c6eae0ab7e3
Author: Keith Miller <[email protected]>
Date: 2026-08-28 (Fri, 28 Aug 2026)
Changed paths:
A JSTests/wasm/stress/block-param-type-widening.js
A JSTests/wasm/stress/loop-param-type-widening.js
M Source/JavaScriptCore/wasm/WasmFunctionParser.h
Log Message:
-----------
[Wasm] Argument and Result block types should always widen
https://bugs.webkit.org/show_bug.cgi?id=318807
rdar://181458746
Reviewed by Yusuke Suzuki.
The wasm spec says that any types passing through a block signature
have to widen to the signature. This is critical both for correctness
and for security. We didn't widen in most cases, this change widens
any time we enter or exit a block via fallthroughs.
In the branch case we don't always widen. For br_table in
particular, we
have to check against each branch target, which may have different
target types but the concrete value type could be a subtype of all of
them. If we widened the first checked target would pass but on a second
(or later) it might fail with the first's widened type.
Tests: JSTests/wasm/stress/block-param-type-widening.js
JSTests/wasm/stress/loop-param-type-widening.js
Originally-landed-as: [email protected] (0aff244e6923).
rdar://185368381
Canonical link:
https://flagged.apple.com:443/proxy?t2=Dn1Y3W5pa2&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzIwMDcxQG1haW4=&emid=6829a710-54e3-4b84-a452-cbad46527b17&c=11
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
