Bug 253592

Summary: Fix result height when folding select in WasmBBQJIT
Product: WebKit Reporter: David Degazio <d_degazio>
Component: WebAssemblyAssignee: David Degazio <d_degazio>
Status: RESOLVED FIXED    
Severity: Normal CC: webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   

Description David Degazio 2023-03-08 11:55:27 PST 
rdar://106420016

When BBQ JIT folds a WASM select instruction (when its condition is a constant), it currently naively selects between the left and right operands and consumes whichever one wasn't selected. This works fine if the result is a constant, but it's possible for this to result in an incorrect stack height. For example, if we have:

    Select Temp(0), Temp(1), Const(1)

...then we will set the result to Temp(1), despite the fact that after all the operands of Select are popped, the result should be at height 0. To fix this, we just need to consume all operands like we do in the non-folded case, then independently push and allocate the result temp.
Comment 1 David Degazio 2023-03-08 12:02:34 PST 
Pull request: https://github.com/WebKit/WebKit/pull/11247
Comment 2 EWS 2023-03-09 13:27:14 PST 
Committed 261461@main (c0310d30906b): <https://commits.webkit.org/261461@main>

Reviewed commits have been landed. Closing PR #11247 and removing active labels.