Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6ae2e2fec95a69df465f85e1a85925e20b6897e3
https://github.com/WebKit/WebKit/commit/6ae2e2fec95a69df465f85e1a85925e20b6897e3
Author: Sergey Rubanov <[email protected]>
Date: 2026-09-05 (Sat, 05 Sep 2026)
Changed paths:
M JSTests/wasm/gc/i31.js
M Source/JavaScriptCore/wasm/WasmFunctionParser.h
Log Message:
-----------
[JSC][Wasm] Accept bottom refs in i31.get_s and i31.get_u
https://bugs.webkit.org/show_bug.cgi?id=322836
Reviewed by Yusuke Suzuki.
i31.get_s and i31.get_u take (ref null i31). none is a subtype of
i31 so (ref none) and (ref null none) must validate. They still trap
if the value is null. The validator required an exact i31ref heap
type, which rejected Binaryen output that canonicalizes ref.null i31
to ref.null none.
* Source/JavaScriptCore/wasm/WasmFunctionParser.h:
* JSTests/wasm/gc/i31.js:
Canonical link: https://commits.webkit.org/320578@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
