Skip to content

fix(jsc): correct ARM64 register-to-memory add64 operands - #770

Open
steipete wants to merge 1 commit into
oven-sh:mainfrom
steipete:fix/arm64-add64-upstream
Open

steipete wants to merge 1 commit into
oven-sh:mainfrom
steipete:fix/arm64-add64-upstream

Conversation

@steipete

@steipete steipete commented Oct 5, 2026

Copy link
Copy Markdown

MacroAssemblerARM64::add64(RegisterID src, Address dest) passes its operands to ARM64Assembler::add in the wrong order. That lower-level API takes (destination, left, right), so the current helper overwrites src with twice the old memory value and then stores the unchanged temporary. Put dataTempRegister first to implement the existing *dest += src contract and preserve src.

The testmasm regression checks 169 pairs of 64-bit operands, including wraparound and signed extrema, as well as source-register preservation and neighboring memory. On native macOS ARM64 the regression fails before the fix (expected memory 1, actual 0), passes after, and the complete 466-test assembler suite passes. The same two changed files also pass all 466 assembler tests on native Linux ARM64. The downstream engine qualification passes 1,778 stress configurations, 1,639 module configurations, FFI, and five explicit accounting and sampling modes on each platform. Native Linux ARM64 proof.

An added downstream DFG typed-array accounting path exposed this. At the current pinned source, the upstream allocation helper's register-to-memory add64 callers are guarded by CPU(X86_64), and Air permits these memory forms only on x86-64. I found no production ARM64 caller in this revision. The sibling ARM64 add/sub/and/or memory helpers and xor64 counterpart use the correct operand order.

@claude claude Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

@coderabbitai

coderabbitai Bot commented Oct 5, 2026

Copy link
Copy Markdown

Review in Change Stack →

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

🧰 Additional context used
📚 Code guidelines (2)
CLAUDE.md — auto-discovered
Source/JavaScriptCore/CLAUDE.md — auto-discovered

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: a12ba044-693c-4b14-a3b5-2073cdfafcac
📥 Commits

Reviewing files that changed from the base of the PR and between 5718a6e and d5de18d.

📒 Files selected for processing (2)
  • Source/JavaScriptCore/assembler/MacroAssemblerARM64.h
  • Source/JavaScriptCore/assembler/testmasm.cpp

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.


Walkthrough

MacroAssemblerARM64::add64(RegisterID, Address) now adds the source register to the value loaded from memory. A registered test checks the stored sum, confirms the source register remains unchanged, and verifies neighboring array elements.

Changes

ARM64 register-to-memory addition

Layer / File(s) Summary
Addition behavior and validation
Source/JavaScriptCore/assembler/MacroAssemblerARM64.h, Source/JavaScriptCore/assembler/testmasm.cpp
The assembler method changes operand order. The new test checks the memory result, returned source value, and unchanged neighboring elements across int64Operands() inputs. The test is registered in the runner.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to d5de1

The change is intended to correct ARM64 register-to-memory addition and add regression coverage. No concrete remaining failure is established in the supplied review context, so no actionable merge blocker is identified.

🚥 Pre-merge checks | ✅ 4
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely identifies the ARM64 add64 operand-order fix.
Description check ✅ Passed The description explains the bug, the fix, the regression test, and reported test results. It omits the Bugzilla link and the template’s explicit changed-file list, but it is otherwise sufficiently de…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Git: CodeRabbit could not clone the repository, so clone-backed analysis was skipped and this review may be incomplete. Verify repository clone access, such as SSH credentials, before requesting another full review. If clone access is intentionally unavailable, use path_filters to narrow the review scope.


Comment @coderabbitai help to get the list of available commands.

steipete added a commit to openclaw/WebKit that referenced this pull request Oct 5, 2026
Correct ARM64 MacroAssembler register-to-memory add64 destination order, restoring DFG typed-array accounting while preserving the source register. Add the 169-pair testmasm regression and native ARM64 qualification across interpreter, baseline, DFG, FTL and concurrent-GC modes.

Bring the four already-qualified promise stack goldens from the release line to main so their expected columns match the existing syntax-token semantics. Preserve every assertion. Keep qualification environment variables out of JSC's engine-option namespace.

Native macOS and Linux ARM64 pass the assembler regression and full qualification selection. The upstream two-file correction is oven-sh#770; immutable artifact publication is handled by the release-line counterpart.
steipete added a commit to openclaw/WebKit that referenced this pull request Oct 5, 2026
ARM64Assembler::add takes destination first. Correct MacroAssemblerARM64's register-to-memory add64 so it writes the sum to memory and preserves the source register, restoring DFG typed-array allocation accounting.

Add a testmasm regression covering 169 operand pairs, 64-bit wraparound, source preservation and neighboring memory. Qualify native macOS and Linux ARM64 with 466 assembler tests, 1,778 stress and 1,639 module configurations, FFI and five accounting/sampling modes. Require five archive-bound Windows ARM64 accounting modes before publication while preserving the ten-archive matrix and upstream recipes.

The native regression fails before the correction and passes after. Upstream patch: oven-sh#770.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant