268848 2024-02-06 12:08:25 -0800 [Wasm-GC] Fix br_on_cast issue on BBQ 2024-03-11 12:24:34 -0700 1 1 1 Unclassified WebKit WebAssembly WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 247394 1 asumu webkit-unassigned bashorov webkit-bug-importer oldest_to_newest 2011119 0 asumu 2024-02-06 12:08:25 -0800 There's a bug in the handling of `br_on_cast` on the BBQJIT tier. Test case: ``` diff --git a/JSTests/wasm/gc/br_on_cast.js b/JSTests/wasm/gc/br_on_cast.js index dbf465442c6b..f62897236627 100644 --- a/JSTests/wasm/gc/br_on_cast.js +++ b/JSTests/wasm/gc/br_on_cast.js @@ -116,6 +116,22 @@ function testBrOnCast() { assert.eq(m.exports.f1(), 1); assert.eq(m.exports.f2(), 0); } + + { + let m = instantiate(` + (module + (type (struct)) + (type (struct (field (ref null 0)))) + (global (ref 1) (struct.new 1 (struct.new 0))) + (func (export "f") (param) (result structref) + (block $exit (result structref) + (struct.get 1 0 + (br_on_cast_fail $exit structref (ref 1) + (global.get 0))))) + ) + `); + m.exports.f(); + } } testBrOnCastValidation(); ``` The test runs fine in LLInt and OMG tiers though. I think it has to do with register allocation or the stack handling in BBQ (which is generally trickier than in those tiers, especially for this instruction). 2011458 1 asumu 2024-02-07 10:58:42 -0800 Pull request: https://github.com/WebKit/WebKit/pull/24016 2013251 2 webkit-bug-importer 2024-02-13 12:09:16 -0800 <rdar://problem/122902355> 2020201 3 ews-feeder 2024-03-11 12:24:32 -0700 Committed 275920@main (d8ada2256e9e): <https://commits.webkit.org/275920@main> Reviewed commits have been landed. Closing PR #24016 and removing active labels.