Bug 253592
| Summary: | Fix result height when folding select in WasmBBQJIT | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | David Degazio <d_degazio> |
| Component: | WebAssembly | Assignee: | David Degazio <d_degazio> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
David Degazio
rdar://106420016
When BBQ JIT folds a WASM select instruction (when its condition is a constant), it currently naively selects between the left and right operands and consumes whichever one wasn't selected. This works fine if the result is a constant, but it's possible for this to result in an incorrect stack height. For example, if we have:
Select Temp(0), Temp(1), Const(1)
...then we will set the result to Temp(1), despite the fact that after all the operands of Select are popped, the result should be at height 0. To fix this, we just need to consume all operands like we do in the non-folded case, then independently push and allocate the result temp.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
David Degazio
Pull request: https://github.com/WebKit/WebKit/pull/11247
EWS
Committed 261461@main (c0310d30906b): <https://commits.webkit.org/261461@main>
Reviewed commits have been landed. Closing PR #11247 and removing active labels.