Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 78fb97044c74f29aaf46193b94d6218cb60c99bd
https://github.com/WebKit/WebKit/commit/78fb97044c74f29aaf46193b94d6218cb60c99bd
Author: Keith Miller <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
A JSTests/wasm/stress/unreachable-end-if-no-else-widens-to-signature.js
M Source/JavaScriptCore/wasm/WasmFunctionParser.h
Log Message:
-----------
Cherry-pick [email protected] (f65ca49ea4a7).
https://bugs.webkit.org/show_bug.cgi?id=318480
[Wasm] Unreachable end ops don't widen result types
https://bugs.webkit.org/show_bug.cgi?id=318480
rdar://180535979
Reviewed by Yusuke Suzuki.
In [email protected] we fixed how result types were
pushed onto the wasm value stack, widening them to the expected type
rather than the last predecessor's type at the merge.
This missed the case for unreachable expressions in the block, which
is fixed in this patch.
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1171@webkitglib/2.52
Commit: 6360962b83fae44a3324e0cd9baef9a2cdd95517
https://github.com/WebKit/WebKit/commit/6360962b83fae44a3324e0cd9baef9a2cdd95517
Author: Jean-Yves Avenard <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
M LayoutTests/TestExpectations
A
LayoutTests/media/media-source/media-source-webm-reversed-timestamps-crash-expected.txt
A
LayoutTests/media/media-source/media-source-webm-reversed-timestamps-crash.html
M Source/WebCore/Modules/mediasource/SampleMap.cpp
M Source/WebCore/platform/graphics/cocoa/SourceBufferParserWebM.cpp
M Tools/TestWebKitAPI/Tests/WebCore/SampleMap.cpp
Log Message:
-----------
Cherry-pick [email protected] (bd4c91c57d10).
https://bugs.webkit.org/show_bug.cgi?id=318480
Malformed WebM with non-monotonically increasing presentation timestamps
can cause a crash.
rdar://177494050
Reviewed by Eric Carlson.
We guard against non-monotonically increasing presentation timestamps in
SourceBufferParserWebM
and SampleMap
Tests: media/media-source/media-source-webm-reversed-timestamps-crash.html
Tools/TestWebKitAPI/Tests/WebCore/SampleMap.cpp
*
LayoutTests/media/media-source/media-source-webm-reversed-timestamps-crash-expected.txt:
Added.
*
LayoutTests/media/media-source/media-source-webm-reversed-timestamps-crash.html:
Added.
* Source/WebCore/Modules/mediasource/SampleMap.cpp:
(WebCore::PresentationOrderSampleMap::findSamplesBetweenPresentationTimes):
(WebCore::PresentationOrderSampleMap::findSamplesBetweenPresentationTimesFromEnd):
* Source/WebCore/platform/graphics/cocoa/SourceBufferParserWebM.cpp:
(WebCore::WebMParser::VideoTrackData::processPendingMediaSamples):
* Tools/TestWebKitAPI/Tests/WebCore/SampleMap.cpp:
(TestWebKitAPI::TEST_F(SampleMapTest, findSamplesBetweenPresentationTimes)):
(TestWebKitAPI::TEST_F(SampleMapTest,
findSamplesBetweenPresentationTimesFromEnd)):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1172@webkitglib/2.52
Commit: c31030bfedab2087992dd22757f54f0fc0d561fb
https://github.com/WebKit/WebKit/commit/c31030bfedab2087992dd22757f54f0fc0d561fb
Author: Keith Miller <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
A JSTests/wasm/stress/delegate-widens-result-type-to-signature.js
M Source/JavaScriptCore/wasm/WasmFunctionParser.h
Log Message:
-----------
Cherry-pick [email protected] (db3010593c27).
https://bugs.webkit.org/show_bug.cgi?id=318755
[Wasm] Delegate should widen types like End
https://bugs.webkit.org/show_bug.cgi?id=318755
rdar://181457816
Reviewed by Yusuke Suzuki.
The legacy Delegate wasm bytecode is essentially shorthand for: `Rethrow;
End`. So like other merge points it needs to widen the types on the
expression stack. To help avoid this problem in the future add a new
helper `endBlockAndCheckResultTypes`, which ensures the types are
appropriately widened.
Test: JSTests/wasm/stress/delegate-widens-result-type-to-signature.js
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1173@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/1a02b444ed81...c31030bfedab
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
