[webkit-changes] [WebKit/WebKit] f4cd23: Fix Wasm LLInt's marshalling of i32 args to JS

[Ross Kirsling]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: f4cd23d010b72c590f2deb0b201dab0cdd7e465d
      https://github.com/WebKit/WebKit/commit/f4cd23d010b72c590f2deb0b201dab0cdd7e465d
  Author: Ross Kirsling <ross.kirsling at sony.com>
  Date:   2024-09-25 (Wed, 25 Sep 2024)

  Changed paths:
    M Source/JavaScriptCore/wasm/WasmOperations.cpp

  Log Message:
  -----------
  Fix Wasm LLInt's marshalling of i32 args to JS
https://bugs.webkit.org/show_bug.cgi?id=280326

Reviewed by Yusuke Suzuki and Keith Miller.

Wasm LLInt is currently unable to correctly pass (non-stack) i32 arguments to a JS function,
as we're indexing with the implicit integer value of each GPR instead of consciously converting it to an index.

For example, if we pass `41, 42, 43, 44, 45, 46` from Wasm, our JS function will receive something like this on x86_64:

    0                   from %rdi (implicit value 7, should be index 0)
    1                   from %rsi (implicit value 6, should be index 1)
    43                  from %rdx (implicit value 2, should be index 2)
    42                  from %rcx (implicit value 1, should be index 3)
    7308604759965200997 from %r8  (implicit value 8, should be index 4)
    1644930307          from %r9  (implicit value 9, should be index 5)

...and we'll see a similar situation when using multiple return values from that JS function.

Ultimately, we just need a gprToIndex() call; kind of interesting that only the (non-stack) i32 path has this issue.

* Source/JavaScriptCore/wasm/WasmOperations.cpp:
(JSC::Wasm::JSC_DEFINE_JIT_OPERATION):

Canonical link: https://commits.webkit.org/284262@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications