From d5de18dcb8f765a356c4d678c446d0de46230fe6 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Mon, 5 Oct 2026 04:35:28 -0700
Subject: [PATCH] fix(jsc): correct ARM64 register-to-memory add64 operands

---
 .../assembler/MacroAssemblerARM64.h           |  2 +-
 Source/JavaScriptCore/assembler/testmasm.cpp  | 23 +++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h b/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h
index 17088a7e5f519..144b6b7b47b55 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h
@@ -453,7 +453,7 @@ class MacroAssemblerARM64 : public AbstractMacroAssembler<Assembler> {
     void add64(RegisterID src, Address dest)
     {
         load64(dest, getCachedDataTempRegisterIDAndInvalidate());
-        m_assembler.add<64>(src, dataTempRegister, dataTempRegister);
+        m_assembler.add<64>(dataTempRegister, dataTempRegister, src);
         store64(dataTempRegister, dest);
     }
 
diff --git a/Source/JavaScriptCore/assembler/testmasm.cpp b/Source/JavaScriptCore/assembler/testmasm.cpp
index 3f495628f492d..07351f816cee3 100644
--- a/Source/JavaScriptCore/assembler/testmasm.cpp
+++ b/Source/JavaScriptCore/assembler/testmasm.cpp
@@ -1028,6 +1028,28 @@ void testAdd64Imm32()
     }
 }
 
+void testAdd64RegisterAddress()
+{
+    auto add = compile([] (CCallHelpers& jit) {
+        emitFunctionPrologue(jit);
+        jit.add64(GPRInfo::argumentGPR1, CCallHelpers::Address(GPRInfo::argumentGPR0, sizeof(uint64_t)));
+        jit.move(GPRInfo::argumentGPR1, GPRInfo::returnValueGPR);
+        emitFunctionEpilogue(jit);
+        jit.ret();
+    });
+
+    for (auto initial : int64Operands()) {
+        for (auto source : int64Operands()) {
+            uint64_t values[] = { 0x0123456789abcdefULL, static_cast<uint64_t>(initial), 0xfedcba9876543210ULL };
+            auto result = invoke<uint64_t>(add, values, static_cast<uint64_t>(source));
+            CHECK_EQ(values[1], static_cast<uint64_t>(initial) + static_cast<uint64_t>(source));
+            CHECK_EQ(result, static_cast<uint64_t>(source));
+            CHECK_EQ(values[0], 0x0123456789abcdefULL);
+            CHECK_EQ(values[2], 0xfedcba9876543210ULL);
+        }
+    }
+}
+
 void testAdd64ArgImm32()
 {
     for (auto immediate : int32Operands()) {
@@ -8534,6 +8556,7 @@ void run(const char* filter) WTF_IGNORES_THREAD_SAFETY_ANALYSIS
     RUN(testAdd32Imm());
     RUN(testAdd32ArgImm());
     RUN(testAdd64Imm32());
+    RUN(testAdd64RegisterAddress());
     RUN(testAdd64ArgImm32());
     RUN(testAdd64Imm64());
     RUN(testAdd64ArgImm64());