<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>297899</bug_id>
          
          <creation_ts>2025-08-26 06:02:46 -0700</creation_ts>
          <short_desc>[JSC][ARM] Fix stack pointer adjustment in JSToWasm</short_desc>
          <delta_ts>2025-08-26 07:28:17 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Mikhail R. Gadelha">mikhail</reporter>
          <assigned_to name="Mikhail R. Gadelha">mikhail</assigned_to>
          <cc>webkit-bug-importer</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>2138788</commentid>
    <comment_count>0</comment_count>
    <who name="Mikhail R. Gadelha">mikhail</who>
    <bug_when>2025-08-26 06:02:46 -0700</bug_when>
    <thetext>In JSToWasm, we push 8 bytes to the stack before calling operationJSToWasmEntryWrapperBuildFrame, but when restoring sp, we would pop 16 bytes, leading to corrupted arguments in the jitted function. This PR fixes the issue by pop 8 bytes.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2138789</commentid>
    <comment_count>1</comment_count>
    <who name="Mikhail R. Gadelha">mikhail</who>
    <bug_when>2025-08-26 06:05:45 -0700</bug_when>
    <thetext>Pull request: https://github.com/WebKit/WebKit/pull/49880</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2138802</commentid>
    <comment_count>2</comment_count>
    <who name="EWS">ews-feeder</who>
    <bug_when>2025-08-26 07:27:58 -0700</bug_when>
    <thetext>Committed 299158@main (0ad56d6165be): &lt;https://commits.webkit.org/299158@main&gt;

Reviewed commits have been landed. Closing PR #49880 and removing active labels.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2138803</commentid>
    <comment_count>3</comment_count>
    <who name="Radar WebKit Bug Importer">webkit-bug-importer</who>
    <bug_when>2025-08-26 07:28:17 -0700</bug_when>
    <thetext>&lt;rdar://problem/159192774&gt;</thetext>
  </long_desc>
      
      

    </bug>

</bugzilla>