Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 0cc69e2993f4dc953765fd64593ae2579752132f
https://github.com/WebKit/WebKit/commit/0cc69e2993f4dc953765fd64593ae2579752132f
Author: Yusuke Suzuki <[email protected]>
Date: 2026-08-04 (Tue, 04 Aug 2026)
Changed paths:
M Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
M Source/JavaScriptCore/wasm/WasmBBQJIT.h
M Source/JavaScriptCore/wasm/WasmBBQJIT64.h
Log Message:
-----------
[JSC] BBQ materializePointer should take uint64_t offset
https://bugs.webkit.org/show_bug.cgi?id=321043
rdar://184072653
Reviewed by Keith Miller.
For 64bit address, we first do bound-check and after that, we
materialize a pointer. Currently since we are not supporting memory size
more than 4GB, this truncation does not matter, but we should have
uint64_t as an offset when we really want to have 64bit pointer. This
patch fixes it. Note that we never have overflow by adding 64bit offset
here since we already did bound-check and that already guaranteed this
pointer's validity. We also fixes recordJumpToThrowException cases to
correctly drain a pointer and returning garbage register even though we
are throwing an error.
* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:
(JSC::Wasm::BBQJITImpl::BBQJIT::materializePointer):
* Source/JavaScriptCore/wasm/WasmBBQJIT.h:
(JSC::Wasm::BBQJITImpl::BBQJIT::emitCheckAndPreparePointer):
* Source/JavaScriptCore/wasm/WasmBBQJIT64.h:
(JSC::Wasm::BBQJITImpl::BBQJIT::emitCheckAndPrepareAndMaterializePointerApply):
Canonical link: https://commits.webkit.org/318606@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
