Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: f0525ca5fa8684f84223ce75cbe7b255c59a0413
https://github.com/WebKit/WebKit/commit/f0525ca5fa8684f84223ce75cbe7b255c59a0413
Author: Sosuke Suzuki <[email protected]>
Date: 2026-10-13 (Tue, 13 Oct 2026)
Changed paths:
A
JSTests/wasm/stress/bbq-multi-value-block-local-result-above-enclosing-stack.js
M Source/JavaScriptCore/wasm/WasmBBQJIT.cpp
Log Message:
-----------
[Wasm] BBQ should flush only the block's results at the end of a block
https://bugs.webkit.org/show_bug.cgi?id=327244
Reviewed by Yusuke Suzuki.
At the end of a block, FunctionParser passes the entries of the enclosing
block followed by the results of the ending block. BBQ gave this whole span to
ControlData::flushAndSingleExit(), which numbers temps on the assumption that
the span starts at the base of the ending block.
Since 323294@main, a local.get result stays on the expression stack as a local,
and flushAtBlockBoundary() renames it to a temp. When the enclosing block has
entries, the local gets the temp index of another result, and the results are
mixed up:
(i32.const 100)
(block (result i32 i32)
(local.get 0)
(i32.add (local.get 1) (i32.const 3)))
This patch passes only the results, as OMG and IPInt already do.
Test:
JSTests/wasm/stress/bbq-multi-value-block-local-result-above-enclosing-stack.js
*
JSTests/wasm/stress/bbq-multi-value-block-local-result-above-enclosing-stack.js:
Added.
* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:
(JSC::Wasm::BBQJITImpl::BBQJIT::addEndToUnreachableImpl):
Canonical link: https://commits.webkit.org/323660@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
