Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 10d4d20f5b6c1db2127d5fb7fd0fae533a092b57
https://github.com/WebKit/WebKit/commit/10d4d20f5b6c1db2127d5fb7fd0fae533a092b57
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-07 (Mon, 07 Sep 2026)
Changed paths:
M Source/JavaScriptCore/b3/B3LowerToAir.cpp
M Source/JavaScriptCore/b3/testb3.h
M Source/JavaScriptCore/b3/testb3_1.cpp
M Source/JavaScriptCore/b3/testb3_7.cpp
Log Message:
-----------
[JSC] Folding `Shl` into `WasmAddress` index form can use a locked value's
`Tmp`
https://bugs.webkit.org/show_bug.cgi?id=323582
Reviewed by Keith Miller.
Since 320441@main the WasmAddress case of effectiveAddr() folds a
pointer-width Shl into the index scale, but unlike the sibling Add and Shl
cases it does not check m_locked. Blocks are lowered in pre-order, so a Shl
sitting in an earlier block than the memory access is lowered first, and on
ARM64 a Shl whose child is a single-use BitAnd or ZExt32(Trunc) commits that
child internally into a UBFIZ. The fold then asks tmp() for the locked child
and gets a Tmp no instruction defines, so the access runs on base plus an
undefined index register while the bounds check still tests the correct
pointer.
Skip the fold when the Shl's child is locked, matching the Add case; the
address then falls back to the Shl's own Tmp with scale 1.
Tests: Source/JavaScriptCore/b3/testb3_1.cpp
Source/JavaScriptCore/b3/testb3_7.cpp
* Source/JavaScriptCore/b3/B3LowerToAir.cpp:
* Source/JavaScriptCore/b3/testb3.h:
* Source/JavaScriptCore/b3/testb3_1.cpp:
(run):
* Source/JavaScriptCore/b3/testb3_7.cpp:
(testWasmAddressScaledIndexWithLockedShlChild):
Canonical link: https://commits.webkit.org/320618@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
