Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 778a559d303abfb1b980ef6b7503cb3d44d62487
https://github.com/WebKit/WebKit/commit/778a559d303abfb1b980ef6b7503cb3d44d62487
Author: Yijia Huang <[email protected]>
Date: 2026-09-22 (Tue, 22 Sep 2026)
Changed paths:
A JSTests/wasm/debugger/resources/wasm/cross-instance-tail-call-import.js
A JSTests/wasm/debugger/resources/wasm/cross-instance-tail-call.js
A JSTests/wasm/debugger/resources/wasm/depth-call-ref.js
A JSTests/wasm/debugger/resources/wasm/depth-call-shapes.js
A JSTests/wasm/debugger/resources/wasm/depth-catch-handler.js
A JSTests/wasm/debugger/resources/wasm/depth-duplicate-import.js
A JSTests/wasm/debugger/resources/wasm/depth-import-arity.js
A JSTests/wasm/debugger/resources/wasm/depth-import-multires.js
A JSTests/wasm/debugger/resources/wasm/depth-js-js-wasm-js-js-wasm.js
A JSTests/wasm/debugger/resources/wasm/depth-js-wasm-js-wasm.js
A JSTests/wasm/debugger/resources/wasm/depth-return-call.js
A JSTests/wasm/debugger/resources/wasm/depth-wasm-js-wasm-js-wasm.js
A JSTests/wasm/debugger/resources/wasm/depth-wasm-wasm-js-wasm-wasm.js
A JSTests/wasm/debugger/resources/wasm/depth-wasm-wasm-wasm.js
A JSTests/wasm/debugger/resources/wasm/tail-call-to-import.js
M JSTests/wasm/debugger/tests/tests.py
M Source/JavaScriptCore/jit/GPRInfo.h
M Source/JavaScriptCore/llint/InPlaceInterpreter.asm
M Source/JavaScriptCore/wasm/WasmCallingConvention.h
M Source/JavaScriptCore/wasm/debugger/WasmDebugServerUtilities.cpp
M Source/JavaScriptCore/wasm/debugger/WasmDebugServerUtilities.h
M Source/JavaScriptCore/wasm/debugger/WasmQueryHandler.cpp
M Source/JavaScriptCore/wasm/js/WasmToJS.cpp
Log Message:
-----------
[JSC] WASM debugger: answer qWasmStackValue for caller frames
https://bugs.webkit.org/show_bug.cgi?id=324832
rdar://188104327
Reviewed by Vassili Bykov.
321456@main answered frame 0, where StopData records a live operand stack
pointer. A
suspended frame has none, so its depth has to be recovered from the frame.
.ipint_call_common saves four slots between the caller's operand stack and the
callee's
frame. Two of them answer it: the stack top the caller resumes with, and the
caller's own
metadata MC, whose CallSignatureMetadata holds the arity of the call it made.
Both are read
where _wasm_ipint_call_return_location reads them, so the debugger cannot drift
from the
engine. Those slots are located from ThisArgumentOffset[cfr] plus the frame
size the call
reserved, taken from the CallReturnMetadata that the callee's spilled MC points
at.
The arity has to come from that saved MC rather than the callee's signature: a
return_call
replaces the callee, so the surviving frame's signature belongs to a different
function.
An imported call leaves no spilled MC on the stub frame, so both WasmToJS stubs
now store it
beside the IPInt PC they already save.
Also fixes three pre-existing defects in collectCallStack, all cases where a
tail call
removes a frame the walk assumed was still there:
- a cross-instance tail call splices a synthetic RestoreFrameCallee frame in,
which the walk
hit as RELEASE_ASSERT_NOT_REACHED -- a plain `bt` killed the VM. It is now
stepped over,
in getWasmReturnPC too.
- a tail call into an import replaces the caller, so the frame above a WasmToJS
stub need
not be a WASM frame at all. Its three RELEASE_ASSERTs are now a predicate and
a skip.
- the JSToWasm arm committed entryFrame before the callerFrame() call that can
update it,
leaving the tracker describing the wrong stack segment.
qWasmCallStack and qWasmLocal already reached these paths.
Tests: JSTests/wasm/debugger/tests/tests.py
Canonical link: https://commits.webkit.org/321651@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
