Skip to content

Js/Wasm engine produce an invalid ref.cast runtime fail for func.ref types in hot functions. - #46379

Merged
webkit-commit-queue merged 1 commit into
WebKit:mainfrom
Constellation:eng/Js-Wasm-engine-produce-an-invalid-ref-cast-runtime-fail-for-func-ref-types-in-hot-functions
Jun 6, 2025
Merged

Js/Wasm engine produce an invalid ref.cast runtime fail for func.ref types in hot functions.#46379
webkit-commit-queue merged 1 commit into
WebKit:mainfrom
Constellation:eng/Js-Wasm-engine-produce-an-invalid-ref-cast-runtime-fail-for-func-ref-types-in-hot-functions

Conversation

@Constellation

@ConstellationConstellation commented Jun 5, 2025•
edited by webkit-early-warning-system
Loading

Copy link
Copy Markdown
Member

f63d690

Js/Wasm engine produce an invalid ref.cast runtime fail for func.ref types in hot functions.
https://bugs.webkit.org/show_bug.cgi?id=293113rdar://151464447
Reviewed by Daniel Liu and Keith Miller.
274558@main changed rtt field of WasmToWasmImportableFunction from
CompactPtr to normal pointer, but it didn't change OMG code generator's
loadCompactPtr. So we are materializing a pointer incorrectly. This
patch removes loadCompactPtr and use normal Load for OMG.
* JSTests/wasm/stress/resources/wasm-gc-ref-cast.wasm: Added.
* JSTests/wasm/stress/resources/wasm-gc-ref-cast.wat: Added.
* JSTests/wasm/stress/wasm-gc-ref-cast.mjs: Added.
* Source/JavaScriptCore/wasm/WasmFormat.h:
* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:
(JSC::Wasm::OMGIRGenerator::emitLoadRTTFromFuncref):
* Source/JavaScriptCore/wasm/WasmOMGIRGenerator32_64.cpp:
(JSC::Wasm::OMGIRGenerator::emitLoadRTTFromFuncref):
Canonical link: https://commits.webkit.org/295902@main

caa6d1b

MisciOS, visionOS, tvOS & watchOSmacOSLinuxWindows
✅ 🧪 style✅ 🛠 ios✅ 🛠 mac✅ 🛠 wpe✅ 🛠 win
✅ 🛠 ios-sim✅ 🛠 mac-AS-debug✅ 🧪 wpe-wk2⏳ 🧪 win-tests
✅ 🧪 webkitperl✅ 🧪 ios-wk2✅ 🧪 api-mac✅ 🧪 api-wpe
✅ 🧪 ios-wk2-wpt✅ 🧪 mac-wk1✅ 🛠 wpe-cairo
🛠 🧪 jsc✅ 🧪 api-ios✅ 🧪 mac-wk2✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64✅ 🛠 vision🧪 mac-AS-debug-wk2✅ 🧪 gtk-wk2
✅ 🛠 vision-sim✅ 🧪 mac-wk2-stress✅ 🧪 api-gtk
✅ 🧪 vision-wk2✅ 🧪 mac-intel-wk2✅ 🛠 playstation
✅ 🛠 🧪 unsafe-merge✅ 🛠 tv✅ 🛠 mac-safer-cpp✅ 🛠 jsc-armv7
✅ 🛠 tv-sim❌ 🧪 jsc-armv7-tests
✅ 🛠 watch
✅ 🛠 watch-sim

@Constellation
Constellation requested a review from a team as a code ownerJune 5, 2025 20:19
@ConstellationConstellation self-assigned this Jun 5, 2025
@ConstellationConstellation added the WebAssembly For bugs in JavaScript WebAssembly label Jun 5, 2025
@webkit-early-warning-system

webkit-early-warning-system commented Jun 5, 2025•
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on previous version of this PR (hash f761f6e)

Details

MisciOS, visionOS, tvOS & watchOSmacOSLinuxWindows
✅ 🧪 style✅ 🛠 ios✅ 🛠 mac✅ 🛠 wpe🛠 win
✅ 🛠 ios-sim✅ 🛠 mac-AS-debug🧪 wpe-wk2🧪 win-tests
✅ 🧪 webkitperl✅ 🧪 ios-wk2✅ 🧪 api-mac✅ 🧪 api-wpe
⏳ 🧪 ios-wk2-wpt✅ 🧪 mac-wk1✅ 🛠 wpe-cairo
🛠 🧪 jsc✅ 🧪 api-ios✅ 🧪 mac-wk2✅ 🛠 gtk
❌ 🛠 🧪 jsc-arm64✅ 🛠 vision✅ 🧪 mac-AS-debug-wk2🧪 gtk-wk2
✅ 🛠 vision-sim✅ 🧪 mac-wk2-stress✅ 🧪 api-gtk
✅ 🧪 vision-wk2✅ 🧪 mac-intel-wk2✅ 🛠 playstation
✅ 🛠 tv✅ 🛠 mac-safer-cpp✅ 🛠 jsc-armv7
✅ 🛠 tv-sim❌ 🧪 jsc-armv7-tests
✅ 🛠 watch
✅ 🛠 watch-sim

danlliu
danlliu approved these changes Jun 5, 2025
View reviewed changes

@danlliudanlliu left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

r=me

@Constellation
Constellationforce-pushed the eng/Js-Wasm-engine-produce-an-invalid-ref-cast-runtime-fail-for-func-ref-types-in-hot-functions branch from f761f6e to 92f245cCompareJune 5, 2025 21:12
@webkit-early-warning-system

webkit-early-warning-system commented Jun 5, 2025•
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on previous version of this PR (hash 92f245c)

Details

MisciOS, visionOS, tvOS & watchOSmacOSLinuxWindows
✅ 🧪 style✅ 🛠 ios✅ 🛠 mac✅ 🛠 wpe✅ 🛠 win
✅ 🛠 ios-sim✅ 🛠 mac-AS-debug🧪 wpe-wk2⏳ 🧪 win-tests
✅ 🧪 webkitperl🧪 ios-wk2✅ 🧪 api-mac✅ 🧪 api-wpe
🧪 ios-wk2-wpt🧪 mac-wk1✅ 🛠 wpe-cairo
🛠 🧪 jsc🧪 api-ios✅ 🧪 mac-wk2✅ 🛠 gtk
❌ 🛠 🧪 jsc-arm64✅ 🛠 vision🧪 mac-AS-debug-wk2⏳ 🧪 gtk-wk2
✅ 🛠 vision-sim✅ 🧪 mac-wk2-stress✅ 🧪 api-gtk
✅ 🧪 vision-wk2⏳ 🧪 mac-intel-wk2✅ 🛠 playstation
✅ 🛠 tv🛠 mac-safer-cpp✅ 🛠 jsc-armv7
✅ 🛠 tv-sim🧪 jsc-armv7-tests
✅ 🛠 watch
✅ 🛠 watch-sim

@Constellation
Constellationforce-pushed the eng/Js-Wasm-engine-produce-an-invalid-ref-cast-runtime-fail-for-func-ref-types-in-hot-functions branch from 92f245c to caa6d1bCompareJune 5, 2025 22:23
@webkit-early-warning-system

webkit-early-warning-system commented Jun 5, 2025•
edited
Loading

Copy link
Copy Markdown
Collaborator

EWS run on current version of this PR (hash caa6d1b)

Details

MisciOS, visionOS, tvOS & watchOSmacOSLinuxWindows
✅ 🧪 style✅ 🛠 ios✅ 🛠 mac✅ 🛠 wpe✅ 🛠 win
✅ 🛠 ios-sim✅ 🛠 mac-AS-debug✅ 🧪 wpe-wk2⏳ 🧪 win-tests
✅ 🧪 webkitperl✅ 🧪 ios-wk2✅ 🧪 api-mac✅ 🧪 api-wpe
✅ 🧪 ios-wk2-wpt✅ 🧪 mac-wk1✅ 🛠 wpe-cairo
🛠 🧪 jsc✅ 🧪 api-ios✅ 🧪 mac-wk2✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64✅ 🛠 vision🧪 mac-AS-debug-wk2✅ 🧪 gtk-wk2
✅ 🛠 vision-sim✅ 🧪 mac-wk2-stress✅ 🧪 api-gtk
✅ 🧪 vision-wk2✅ 🧪 mac-intel-wk2✅ 🛠 playstation
✅ 🛠 🧪 unsafe-merge✅ 🛠 tv✅ 🛠 mac-safer-cpp✅ 🛠 jsc-armv7
✅ 🛠 tv-sim❌ 🧪 jsc-armv7-tests
✅ 🛠 watch
✅ 🛠 watch-sim

kmiller68
kmiller68 approved these changes Jun 5, 2025
View reviewed changes

@kmiller68kmiller68 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

r=me too.

@ConstellationConstellation added the unsafe-merge-queue Applied to send a pull request to merge-queue, but skip building and testing label Jun 6, 2025
@Constellation
Js/Wasm engine produce an invalid ref.cast runtime fail for func.ref …
f63d690
…types in hot functions.
https://bugs.webkit.org/show_bug.cgi?id=293113
rdar://151464447
Reviewed by Daniel Liu and Keith Miller.
274558@main changed rtt field of WasmToWasmImportableFunction from
CompactPtr to normal pointer, but it didn't change OMG code generator's
loadCompactPtr. So we are materializing a pointer incorrectly. This
patch removes loadCompactPtr and use normal Load for OMG.
* JSTests/wasm/stress/resources/wasm-gc-ref-cast.wasm: Added.
* JSTests/wasm/stress/resources/wasm-gc-ref-cast.wat: Added.
* JSTests/wasm/stress/wasm-gc-ref-cast.mjs: Added.
* Source/JavaScriptCore/wasm/WasmFormat.h:
* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:
(JSC::Wasm::OMGIRGenerator::emitLoadRTTFromFuncref):
* Source/JavaScriptCore/wasm/WasmOMGIRGenerator32_64.cpp:
(JSC::Wasm::OMGIRGenerator::emitLoadRTTFromFuncref):
Canonical link: https://commits.webkit.org/295902@main
@webkit-commit-queue
webkit-commit-queueforce-pushed the eng/Js-Wasm-engine-produce-an-invalid-ref-cast-runtime-fail-for-func-ref-types-in-hot-functions branch from caa6d1b to f63d690CompareJune 6, 2025 01:14
@webkit-commit-queue

webkit-commit-queue commented Jun 6, 2025

Copy link
Copy Markdown
Collaborator

Committed 295902@main (f63d690): https://commits.webkit.org/295902@main

Reviewed commits have been landed. Closing PR #46379 and removing active labels.

@webkit-commit-queue
webkit-commit-queue merged commit f63d690 into WebKit:mainJun 6, 2025
@webkit-commit-queuewebkit-commit-queue removed the unsafe-merge-queue Applied to send a pull request to merge-queue, but skip building and testing label Jun 6, 2025
@hoodmanehoodmane mentioned this pull request Jun 11, 2025
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kmiller68kmiller68kmiller68 approved these changes
@danlliudanlliudanlliu approved these changes

Assignees

@ConstellationConstellation

Labels

WebAssemblyFor bugs in JavaScript WebAssembly

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@Constellation@webkit-early-warning-system@webkit-commit-queue@kmiller68@danlliu