Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 4dcc426f83066f24483ac1e8255888d5fab60dfd
https://github.com/WebKit/WebKit/commit/4dcc426f83066f24483ac1e8255888d5fab60dfd
Author: Shu-yu Guo <[email protected]>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
A JSTests/wasm/stress/atomic-cmpxchg-motion-interference.js
M Source/JavaScriptCore/b3/B3LowerToAir.cpp
Log Message:
-----------
[JSC] Check for interference when moving CAS to Branch in Air
https://bugs.webkit.org/show_bug.cgi?id=319842
rdar://182130524
Reviewed by Marcus Plutowski.
When lowering B3 to Air, CAS operations with a single Branch consumer can be
fused into the Branch or be moved to the Branch site. This motion needs to
check for interference. Consider the following wasm snippet:
L1: i32.atomic.rmw.cmpxchg
L2: memory.grow
<some stuff>
L3: if
The cmpxchg in L1 can be moved past the memory.grow in L2 into L3, which is
incorrect
as the Air CAS opcode for L1 may have a stale memory input that
interferes with the grow in L2.
This PR adds interference checks for all CAS motions in B3 to Air lowering.
Test: JSTests/wasm/stress/atomic-cmpxchg-motion-interference.js
Originally-landed-as: 316606.100@safari-7625-branch (1217ca887d85).
rdar://187506940
Canonical link:
https://flagged.apple.com:443/proxy?t2=DN0S5m9Re7&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzIxNTM5QG1haW4=&emid=4838df07-3964-4837-9fc4-9abd920d42e9&c=11
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
