Bug 256331 - Shuffle clobbers indirect call target in BBQ JIT
Summary: Shuffle clobbers indirect call target in BBQ JIT
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebAssembly (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: David Degazio
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2023-05-04 13:09 PDT by David Degazio
Modified: 2023-05-04 16:25 PDT (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description David Degazio 2023-05-04 13:09:02 PDT
rdar://108908936

https://bugs.webkit.org/show_bug.cgi?id=256235 removed some redundant loads and stores from the call code generation in BBQ JIT. As part of this, we now use a parallel move/shuffle to move the arguments into their intended locations per the calling convention. Shuffling can require an extra scratch register, and we currently use wasmScratchGPR.

However, the implementation of indirect calls specifically depends on the target address being kept live in wasmScratchGPR across the parameter passing. If the shuffle touches wasmScratchGPR, it will clobber this address, and likely cause a crash. We should just use a different register for shuffles in indirect calls.
Comment 1 David Degazio 2023-05-04 13:28:50 PDT
Pull request: https://github.com/WebKit/WebKit/pull/13455
Comment 2 EWS 2023-05-04 16:25:25 PDT
Committed 263697@main (c0664686f49d): <https://commits.webkit.org/263697@main>

Reviewed commits have been landed. Closing PR #13455 and removing active labels.