Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 03befd703d60bd42acca6f8a5b364bea0da804d5
https://github.com/WebKit/WebKit/commit/03befd703d60bd42acca6f8a5b364bea0da804d5
Author: Marcus Plutowski <[email protected]>
Date: 2026-09-25 (Fri, 25 Sep 2026)
Changed paths:
M Source/JavaScriptCore/wasm/WasmTypeDefinition.cpp
M Source/JavaScriptCore/wasm/WasmTypeDefinition.h
M Source/JavaScriptCore/wasm/WasmTypeSectionState.h
Log Message:
-----------
Wasm RTT should be compact-allocated
https://bugs.webkit.org/show_bug.cgi?id=323513
rdar://186751068
Reviewed by Vassili Bykov and Yusuke Suzuki.
While Wasm's RTT class is marked
WTF_DEPRECATED_MAKE_FAST_COMPACT_ALLOCATED, the actual
backing memory is allocated internally via tryFastMalloc.
This breaks when the object is plugged into a CompactPointerTuple,
but only when MTE is enabled. Practically, that means only
lockdown mode and ES WCPs, and only on sites that use wasm.
This patch fixes that by using the compact malloc instead.
* Source/JavaScriptCore/wasm/WasmTypeDefinition.cpp:
(JSC::Wasm::RTT::tryCreateFunction):
(JSC::Wasm::RTT::tryCreateStruct):
(JSC::Wasm::RTT::tryCreateArray):
* Source/JavaScriptCore/wasm/WasmTypeDefinition.h:
* Source/JavaScriptCore/wasm/WasmTypeSectionState.h:
Canonical link: https://commits.webkit.org/321946@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
