Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 62c8556e221d1abc89f62ff5bed8df2fa25d3c5b
https://github.com/WebKit/WebKit/commit/62c8556e221d1abc89f62ff5bed8df2fa25d3c5b
Author: Yusuke Suzuki <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
A JSTests/stress/uint32-array-result-int32-dfg.js
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
Log Message:
-----------
Cherry-pick [email protected] (2bc65ac3560e).
https://bugs.webkit.org/show_bug.cgi?id=319112
[JSC] DFG Uint32Array load should consider about Int32 speculation path
https://bugs.webkit.org/show_bug.cgi?id=319112
rdar://176792844
Reviewed by Mark Lam.
DFG Uint32Array GetByVal may have Int32 result with speculation. But the
current code is always using boxed-double for boxed result. We should
use boxed-int32 when this speculation is set. The same thing is already
done in FTL.
Test: JSTests/stress/uint32-array-result-int32-dfg.js
* JSTests/stress/uint32-array-result-int32-dfg.js: Added.
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::setIntTypedArrayLoadResult):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.236@webkitglib/2.54
Commit: 3573d5d06367114016535f94668f46db3885bb09
https://github.com/WebKit/WebKit/commit/3573d5d06367114016535f94668f46db3885bb09
Author: Keith Miller <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
A JSTests/wasm/stress/tail-call-unused-pins.js
M Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp
Log Message:
-----------
Cherry-pick 320061@main (929f6e81e0e0).
https://bugs.webkit.org/show_bug.cgi?id=317654
[Wasm] Exclude wasmBoundsCheckingSizeRegister from the callee saves restored
https://bugs.webkit.org/show_bug.cgi?id=317654
rdar://177693309
Reviewed by Yijia Huang.
GPRInfo::wasmBoundsCheckingSizeRegister (callee save) is only pinned in B3
when
the OMG callee is compiled for MemoryMode::BoundsChecking. In Signaling mode
it stays in B3/Air's mutable register set, and createTailCallPatchpoint
declares the full callee-save set as clobberEarly so that B3 does not place
an input there before the tail-call's parallel move runs. That clobberEarly
causes AirHandleCalleeSaves to include regCS4 in the function's
calleeSaveRegisterAtOffsetList(). The OMG prologue saves
wasmBoundsCheckingSizeRegister to the callee save list and when making a
tail call that callee save is restored after the callee's memory bounds
are set.
The wasm ABI already treats the pinned registers as effectively caller-save
across wasm-to-wasm calls. Tail calls do not restore them either. Restoring
wasmBoundsCheckingSizeRegister to the prologue-saved caller value in
prepareForTailCallImpl is therefore unnecessary.
This patch teaches emitRestoreCalleeSavesFor to take a dontRestoreRegisters
set and uses it from prepareForTailCallImpl to skip
wasmBoundsCheckingSizeRegister. I also added a FIXME at the pinRegister
site noting that wasmBoundsCheckingSizeRegister is effectively caller-save
in the wasm ABI.
Originally-landed-as: [email protected] (654718255548).
rdar://185368944
Canonical link: https://commits.webkit.org/320061@main
Canonical link: https://commits.webkit.org/317695.237@webkitglib/2.54
Commit: 9a76f770c76610b74862a11e6bd19aeaee837e06
https://github.com/WebKit/WebKit/commit/9a76f770c76610b74862a11e6bd19aeaee837e06
Author: Yulun Wu <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
A LayoutTests/svg/animations/smil-seek-huge-repeat-count-crash-expected.txt
A LayoutTests/svg/animations/smil-seek-huge-repeat-count-crash.html
M Source/WebCore/svg/animation/SVGSMILElement.cpp
Log Message:
-----------
Cherry-pick [email protected] (34249048d66d).
https://bugs.webkit.org/show_bug.cgi?id=318405
Clamp repeat count for SVG animation.
https://bugs.webkit.org/show_bug.cgi?id=318405
<rdar://176471329>
Reviewed by Said Abou-Hallawa.
This PR tightens the fix in 301404@main by clamping the repeat count to
an upper bound to prevent overflow.
Also coalesce the repeat events dispatched while seeking: rather than firing
one repeatEvent per skipped interval, dispatch a single repeatEvent. SVG 1.1
Animation defines a repeatEvent as raised each time the element repeats on a
normally-advancing timeline; how many events a discontinuous seek replays
for
the intervals it skips is left to SMIL Animation's timing model, which does
not
require one event per skipped interval (see also the WPT seeking-events-*
tests).
*
LayoutTests/svg/animations/smil-seek-huge-repeat-count-crash-expected.txt:
Added.
* LayoutTests/svg/animations/smil-seek-huge-repeat-count-crash.html: Added.
* Source/WebCore/svg/animation/SVGSMILElement.cpp:
(WebCore::SVGSMILElement::calculateAnimationPercentAndRepeat const):
(WebCore::SVGSMILElement::progress):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.238@webkitglib/2.54
Commit: 96066a337e3ee4443bfc339ccea85d8ebf980d71
https://github.com/WebKit/WebKit/commit/96066a337e3ee4443bfc339ccea85d8ebf980d71
Author: Keith Miller <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
A JSTests/wasm/stress/unreachable-end-if-no-else-widens-to-signature.js
M Source/JavaScriptCore/wasm/WasmFunctionParser.h
Log Message:
-----------
Cherry-pick 320018@main (36058b8e69ac).
https://bugs.webkit.org/show_bug.cgi?id=318480
[Wasm] Unreachable end ops don't widen result types
https://bugs.webkit.org/show_bug.cgi?id=318480
rdar://180535979
Reviewed by Yusuke Suzuki.
In [email protected] we fixed how result types were
pushed onto the wasm value stack, widening them to the expected type
rather than the last predecessor's type at the merge.
This missed the case for unreachable expressions in the block, which
is fixed in this patch.
Originally-landed-as: [email protected] (f65ca49ea4a7).
rdar://185368954
Canonical link: https://commits.webkit.org/320018@main
Canonical link: https://commits.webkit.org/317695.239@webkitglib/2.54
Commit: a614db56d6eff8bc47615291f41feab0f795929c
https://github.com/WebKit/WebKit/commit/a614db56d6eff8bc47615291f41feab0f795929c
Author: Keith Miller <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
A JSTests/wasm/stress/delegate-widens-result-type-to-signature.js
M Source/JavaScriptCore/wasm/WasmFunctionParser.h
Log Message:
-----------
Cherry-pick 320048@main (261bcb42d83f).
https://bugs.webkit.org/show_bug.cgi?id=318755
[Wasm] Delegate should widen types like End
https://bugs.webkit.org/show_bug.cgi?id=318755
rdar://181457816
Reviewed by Yusuke Suzuki.
The legacy Delegate wasm bytecode is essentially shorthand for: `Rethrow;
End`. So like other merge points it needs to widen the types on the
expression stack. To help avoid this problem in the future add a new
helper `endBlockAndCheckResultTypes`, which ensures the types are
appropriately widened.
Test: JSTests/wasm/stress/delegate-widens-result-type-to-signature.js
Originally-landed-as: [email protected] (db3010593c27).
rdar://185366253
Canonical link: https://commits.webkit.org/320048@main
Canonical link: https://commits.webkit.org/317695.240@webkitglib/2.54
Commit: e4f712201a0dc1accaf04377c363e92f280b89fc
https://github.com/WebKit/WebKit/commit/e4f712201a0dc1accaf04377c363e92f280b89fc
Author: Kai Tamkun <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
A JSTests/stress/yarr-jit-non-bmp-backtrack-index-overflow.js
A JSTests/stress/yarr-jit-non-bmp-backtrack-index-underflow.js
M Source/JavaScriptCore/runtime/RegExpMatchesArray.h
Log Message:
-----------
Cherry-pick 320264@main (8f069ce3b3ce).
https://bugs.webkit.org/show_bug.cgi?id=316996
[JSC] YarrJIT non-BMP backtrack trampoline (L>F branch) does not add
firstCharacterAdditionalReadSize to index, returns start > end
https://bugs.webkit.org/show_bug.cgi?id=316996
rdar://177699255
Reviewed by Yijia Huang.
This patch fixes a mistake where firstCharacterAdditionalReadSize isn't
added
to the index register in YarrJIT during backtracking.
Test: JSTests/stress/yarr-jit-non-bmp-backtrack-index-underflow.js
* JSTests/stress/yarr-jit-non-bmp-backtrack-index-overflow.js: Added.
* JSTests/stress/yarr-jit-non-bmp-backtrack-index-underflow.js: Added.
* Source/JavaScriptCore/runtime/RegExpMatchesArray.h:
(JSC::createRegExpMatchesArray):
* Source/JavaScriptCore/yarr/YarrJIT.cpp:
Originally-landed-as: [email protected] (30b9a27b47e8).
rdar://185367107
Canonical link: https://commits.webkit.org/320264@main
Canonical link: https://commits.webkit.org/317695.241@webkitglib/2.54
Commit: 44781232833d490ce7d6e7d7f03a9b2ebc5502ae
https://github.com/WebKit/WebKit/commit/44781232833d490ce7d6e7d7f03a9b2ebc5502ae
Author: Keith Miller <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
A JSTests/wasm/stress/block-param-type-widening.js
A JSTests/wasm/stress/loop-param-type-widening.js
M Source/JavaScriptCore/wasm/WasmFunctionParser.h
Log Message:
-----------
Cherry-pick 320071@main (9dcbd254af21).
https://bugs.webkit.org/show_bug.cgi?id=318807
[Wasm] Argument and Result block types should always widen
https://bugs.webkit.org/show_bug.cgi?id=318807
rdar://181458746
Reviewed by Yusuke Suzuki.
The wasm spec says that any types passing through a block signature
have to widen to the signature. This is critical both for correctness
and for security. We didn't widen in most cases, this change widens
any time we enter or exit a block via fallthroughs.
In the branch case we don't always widen. For br_table in particular, we
have to check against each branch target, which may have different
target types but the concrete value type could be a subtype of all of
them. If we widened the first checked target would pass but on a second
(or later) it might fail with the first's widened type.
Tests: JSTests/wasm/stress/block-param-type-widening.js
JSTests/wasm/stress/loop-param-type-widening.js
Originally-landed-as: [email protected] (0aff244e6923).
rdar://185368381
Canonical link: https://commits.webkit.org/320071@main
Canonical link: https://commits.webkit.org/317695.242@webkitglib/2.54
Compare: https://github.com/WebKit/WebKit/compare/809df762c48b...44781232833d
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
