Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ace190337c8540fda9e61a93c1b29d1a4e619037
https://github.com/WebKit/WebKit/commit/ace190337c8540fda9e61a93c1b29d1a4e619037
Author: Anand Srinivasan <[email protected]>
Date: 2026-09-01 (Tue, 01 Sep 2026)
Changed paths:
A JSTests/wasm/stress/br-on-cast-fail-overlong-leb128.js
A JSTests/wasm/stress/br-on-cast-overlong-leb128.js
M Source/JavaScriptCore/llint/InPlaceInterpreter64.asm
M Source/JavaScriptCore/wasm/WasmIPIntGenerator.cpp
M Source/JavaScriptCore/wasm/WasmIPIntGenerator.h
Log Message:
-----------
IPInt br_on_cast/br_on_cast_fail must handle overlong LEB128 opcode
https://bugs.webkit.org/show_bug.cgi?id=317349
rdar://178289134
Reviewed by Yusuke Suzuki.
Currently IPInt implementations of br_on_cast/br_on_cast_fail assume
flags are at a fixed offset in the instruction but overlong opcodes
are legal and IPInt may use the wrong byte to load flags. This patch
makes the validator cache allowNull in metadata so IPInt no longer
loads from the instruction stream at all.
Tests: JSTests/wasm/stress/br-on-cast-fail-overlong-leb128.js
JSTests/wasm/stress/br-on-cast-overlong-leb128.js
* JSTests/wasm/stress/br-on-cast-fail-overlong-leb128.js: Added.
(uleb):
(section):
(str):
* JSTests/wasm/stress/br-on-cast-overlong-leb128.js: Added.
(uleb):
(section):
(str):
* Source/JavaScriptCore/llint/InPlaceInterpreter64.asm:
* Source/JavaScriptCore/wasm/WasmIPIntGenerator.cpp:
(JSC::Wasm::IPIntGenerator::addRefTest):
(JSC::Wasm::IPIntGenerator::addRefCast):
(JSC::Wasm::IPIntGenerator::addBranchCast):
* Source/JavaScriptCore/wasm/WasmIPIntGenerator.h:
Originally-landed-as: [email protected] (5b76326e8fc9).
rdar://185367884
Canonical link: https://commits.webkit.org/320255@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
