Js/Wasm engine produce an invalid ref.cast runtime fail for func.ref types in hot functions. by Constellation · Pull Request #46379 · WebKit/WebKit · GitHub
Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file not shown.
3,505 changes: 3,505 additions & 0 deletions JSTests/wasm/stress/resources/wasm-gc-ref-cast.wat

Large diffs are not rendered by default.

139 changes: 139 additions & 0 deletions JSTests/wasm/stress/wasm-gc-ref-cast.mjs
2 changes: 1 addition & 1 deletion Source/JavaScriptCore/wasm/WasmFormat.h
Original file line number Diff line number Diff line change
Expand Up @@ -838,7 +838,7 @@ struct WasmToWasmImportableFunction : public WasmCallableFunction {
// FIXME: Pack type index and code pointer into one 64-bit value. See <https://bugs.webkit.org/show_bug.cgi?id=165511>.
TypeIndex typeIndex { TypeDefinition::invalidIndex };
// Used when GC proposal is enabled, otherwise can be null.
const RTT* rtt;
const RTT* rtt { nullptr };
};
using FunctionIndexSpace = Vector<WasmToWasmImportableFunction>;

Expand Down
7 changes: 1 addition & 6 deletions Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -3792,12 +3792,7 @@ void OMGIRGenerator::emitCheckOrBranchForCast(CastKind kind, Value* condition, c

Value* OMGIRGenerator::emitLoadRTTFromFuncref(Value* funcref)
{
PatchpointValue* patch = m_currentBlock->appendNew<PatchpointValue>(m_proc, pointerType(), Origin());
patch->append(funcref, ValueRep::SomeRegister);
patch->setGenerator([](CCallHelpers& jit, const B3::StackmapGenerationParams& params) {
jit.loadCompactPtr(CCallHelpers::Address(params[1].gpr(), WebAssemblyFunctionBase::offsetOfRTT()), params[0].gpr());
});
return patch;
return m_currentBlock->appendNew<MemoryValue>(m_proc, B3::Load, pointerType(), origin(), funcref, safeCast<int32_t>(WebAssemblyFunctionBase::offsetOfRTT()));
}

Value* OMGIRGenerator::decodeNonNullStructure(Value* structureID)
Expand Down
7 changes: 1 addition & 6 deletions Source/JavaScriptCore/wasm/WasmOMGIRGenerator32_64.cpp