RESOLVED FIXED 256331
Shuffle clobbers indirect call target in BBQ JIT 
https://bugs.webkit.org/show_bug.cgi?id=256331
Summary Shuffle clobbers indirect call target in BBQ JIT
David Degazio
Reported 2023-05-04 13:09:02 PDT
rdar://108908936 https://bugs.webkit.org/show_bug.cgi?id=256235 removed some redundant loads and stores from the call code generation in BBQ JIT. As part of this, we now use a parallel move/shuffle to move the arguments into their intended locations per the calling convention. Shuffling can require an extra scratch register, and we currently use wasmScratchGPR. However, the implementation of indirect calls specifically depends on the target address being kept live in wasmScratchGPR across the parameter passing. If the shuffle touches wasmScratchGPR, it will clobber this address, and likely cause a crash. We should just use a different register for shuffles in indirect calls.
Attachments
Add attachment proposed patch, testcase, etc.
David Degazio
Comment 1 2023-05-04 13:28:50 PDT
Pull request: https://github.com/WebKit/WebKit/pull/13455
EWS
Comment 2 2023-05-04 16:25:25 PDT
Committed 263697@main (c0664686f49d): <https://commits.webkit.org/263697@main> Reviewed commits have been landed. Closing PR #13455 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.