diff mbox series

webkitgtk: fix compiling for 32-bit Arm

Message ID 20250807172009.3692562-1-skandigraun@gmail.com
State Under Review
Headers show
Series webkitgtk: fix compiling for 32-bit Arm | expand

Commit Message

Gyorgy Sarvari Aug. 7, 2025, 5:20 p.m. UTC
When compiling for 32-bit Arm taget, the compilation fails with the
following error:

| .../webkitgtk/2.48.5/sources/webkitgtk-2.48.5/Source/JavaScriptCore/offlineasm/ast.rb:1004:in 'Instruction#lowerDefault': Unhandled opcode addq at WebAssembly.asm:739 (due to WebAssembly.asm:739) (LoweringError)

The cause is a recent commit, which introduced an assembly opcode
without gating it, however this opcode is not available on all
platforms.

To avoid the problem, add a patch that reverts this commit on 32-bit Arm
architectures until this is fixed upstream (bugreport submitted).

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 ...ck-289651.534-safari-7621-branch-a8d.patch | 160 ++++++++++++++++++
 meta/recipes-sato/webkit/webkitgtk_2.48.5.bb  |   3 +
 2 files changed, 163 insertions(+)
 create mode 100644 meta/recipes-sato/webkit/webkitgtk/0001-Revert-Cherry-pick-289651.534-safari-7621-branch-a8d.patch

Comments

Gyorgy Sarvari Aug. 9, 2025, 6:22 p.m. UTC | #1
I see this is not in master yet - please ignore this patch in this case.

A fix appeared meanwhile in the upstream repo, will send a patch with a
backport of that.

On 8/7/25 19:20, Gyorgy Sarvari wrote:
> When compiling for 32-bit Arm taget, the compilation fails with the
> following error:
>
> | .../webkitgtk/2.48.5/sources/webkitgtk-2.48.5/Source/JavaScriptCore/offlineasm/ast.rb:1004:in 'Instruction#lowerDefault': Unhandled opcode addq at WebAssembly.asm:739 (due to WebAssembly.asm:739) (LoweringError)
>
> The cause is a recent commit, which introduced an assembly opcode
> without gating it, however this opcode is not available on all
> platforms.
>
> To avoid the problem, add a patch that reverts this commit on 32-bit Arm
> architectures until this is fixed upstream (bugreport submitted).
>
> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
> ---
>  ...ck-289651.534-safari-7621-branch-a8d.patch | 160 ++++++++++++++++++
>  meta/recipes-sato/webkit/webkitgtk_2.48.5.bb  |   3 +
>  2 files changed, 163 insertions(+)
>  create mode 100644 meta/recipes-sato/webkit/webkitgtk/0001-Revert-Cherry-pick-289651.534-safari-7621-branch-a8d.patch
>
> diff --git a/meta/recipes-sato/webkit/webkitgtk/0001-Revert-Cherry-pick-289651.534-safari-7621-branch-a8d.patch b/meta/recipes-sato/webkit/webkitgtk/0001-Revert-Cherry-pick-289651.534-safari-7621-branch-a8d.patch
> new file mode 100644
> index 0000000000..1dc4dc7b69
> --- /dev/null
> +++ b/meta/recipes-sato/webkit/webkitgtk/0001-Revert-Cherry-pick-289651.534-safari-7621-branch-a8d.patch
> @@ -0,0 +1,160 @@
> +From 35e52b719635a004e19726674fd03b4bb3d8f043 Mon Sep 17 00:00:00 2001
> +From: Gyorgy Sarvari <skandigraun@gmail.com>
> +Date: Thu, 7 Aug 2025 18:02:37 +0200
> +Subject: [PATCH] Revert "Cherry-pick 289651.534@safari-7621-branch
> + (a8d546461042). https://bugs.webkit.org/show_bug.cgi?id=292621"
> +
> +This commit causes a build failure on 32-bit arm:
> +webkitgtk-2.48.5/Source/JavaScriptCore/offlineasm/ast.rb:1004:in 'Instruction#lowerDefault': Unhandled opcode addq at WebAssembly.asm:739 (due to WebAssembly.asm:739) (LoweringError)
> +
> +The reverted commit[1] is fixing a potential undefined behavior due
> +to uninitialized memory content, which, by looking at the code, has been present 
> +since 08.2024. (The commit references a bugreport which requires elevated access 
> +rights, so no details are available)
> +
> +[1]: https://github.com/WebKit/WebKit/commit/846b3f034f0021a0e45358b904682bc3de367605
> +
> +Upstream-Status: Inappropriate [cross-compiling workaround. bugreport: https://bugs.webkit.org/show_bug.cgi?id=297062]
> +Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
> +---
> + Source/JavaScriptCore/llint/WebAssembly.asm | 49 +++++----------------
> + Source/JavaScriptCore/wasm/js/JSToWasm.cpp  | 36 +++------------
> + 2 files changed, 18 insertions(+), 67 deletions(-)
> +
> +diff --git a/Source/JavaScriptCore/llint/WebAssembly.asm b/Source/JavaScriptCore/llint/WebAssembly.asm
> +index 1ac3e2accf3c..754909f8c63e 100644
> +--- a/Source/JavaScriptCore/llint/WebAssembly.asm
> ++++ b/Source/JavaScriptCore/llint/WebAssembly.asm
> +@@ -692,6 +692,17 @@ end
> +     loadp Callee[cfr], ws0 # WebAssemblyFunction*
> +     loadp WebAssemblyFunction::m_instance[ws0], wasmInstance
> + 
> ++    # Memory
> ++    if ARM64 or ARM64E
> ++        loadpairq JSWebAssemblyInstance::m_cachedMemory[wasmInstance], memoryBase, boundsCheckingSize
> ++    elsif X86_64
> ++        loadp JSWebAssemblyInstance::m_cachedMemory[wasmInstance], memoryBase
> ++        loadp JSWebAssemblyInstance::m_cachedBoundsCheckingSize[wasmInstance], boundsCheckingSize
> ++    end
> ++    if not ARMv7
> ++        cagedPrimitiveMayBeNull(memoryBase, wa0)
> ++    end
> ++
> +     # Allocate stack space
> +     loadi WebAssemblyFunction::m_frameSize[ws0], wa0
> +     subp sp, wa0, wa0
> +@@ -709,51 +720,15 @@ if ASSERT_ENABLED
> +     end)
> + end
> + 
> +-    # a0 = current stack frame position
> +-    move sp, a0
> +-
> +-    # Save wasmInstance and put the correct Callee into the stack for building the frame
> +-    storep wasmInstance, CodeBlock[cfr]
> +-
> +-if JSVALUE64
> +-    loadp Callee[cfr], memoryBase
> +-    transferp WebAssemblyFunction::m_boxedJSToWasmCallee[ws0], Callee[cfr]
> +-else
> +-    # Store old Callee to the stack temporarily
> +-    loadp Callee[cfr], ws1
> +-    push ws1, ws1
> +-    loadp WebAssemblyFunction::m_boxedJSToWasmCallee[ws0], ws1
> +-    storep ws1, Callee[cfr]
> +-end
> +-
> +     # Prepare frame
> +     move ws0, a2
> +     move cfr, a1
> ++    move sp, a0
> +     cCall3(_operationJSToWasmEntryWrapperBuildFrame)
> + 
> +-    # Restore Callee slot
> +-if JSVALUE64
> +-    storep memoryBase, Callee[cfr]
> +-else
> +-    loadp [sp], ws0
> +-    addq 2 * SlotSize, sp
> +-    storep ws0, Callee[cfr]
> +-end
> +-
> +     btpnz r1, .buildEntryFrameThrew
> +     move r0, ws0
> + 
> +-    # Memory
> +-    if ARM64 or ARM64E
> +-        loadpairq JSWebAssemblyInstance::m_cachedMemory[wasmInstance], memoryBase, boundsCheckingSize
> +-    elsif X86_64
> +-        loadp JSWebAssemblyInstance::m_cachedMemory[wasmInstance], memoryBase
> +-        loadp JSWebAssemblyInstance::m_cachedBoundsCheckingSize[wasmInstance], boundsCheckingSize
> +-    end
> +-    if not ARMv7
> +-        cagedPrimitiveMayBeNull(memoryBase, wa0)
> +-    end
> +-
> +     # Arguments
> + 
> + if ARM64 or ARM64E
> +diff --git a/Source/JavaScriptCore/wasm/js/JSToWasm.cpp b/Source/JavaScriptCore/wasm/js/JSToWasm.cpp
> +index 10f0771538e6..812b9ae70af3 100644
> +--- a/Source/JavaScriptCore/wasm/js/JSToWasm.cpp
> ++++ b/Source/JavaScriptCore/wasm/js/JSToWasm.cpp
> +@@ -241,6 +241,11 @@ MacroAssemblerCodeRef<JITThunkPtrTag> createJSToWasmJITShared()
> + 
> +         jit.loadPtr(CCallHelpers::addressFor(CallFrameSlot::callee), GPRInfo::regWS0);
> +         jit.loadPtr(CCallHelpers::Address(GPRInfo::regWS0, WebAssemblyFunction::offsetOfInstance()), GPRInfo::wasmContextInstancePointer);
> ++        // Memory
> ++#if USE(JSVALUE64)
> ++        jit.loadPair64(GPRInfo::wasmContextInstancePointer, CCallHelpers::TrustedImm32(JSWebAssemblyInstance::offsetOfCachedMemory()), GPRInfo::wasmBaseMemoryPointer, GPRInfo::wasmBoundsCheckingSizeRegister);
> ++        jit.cageConditionally(Gigacage::Primitive, GPRInfo::wasmBaseMemoryPointer, GPRInfo::wasmBoundsCheckingSizeRegister, GPRInfo::regWA0);
> ++#endif
> + 
> +         // Now, the current frame is fully set up for exceptions.
> +         // Allocate stack space
> +@@ -254,44 +259,15 @@ MacroAssemblerCodeRef<JITThunkPtrTag> createJSToWasmJITShared()
> +         stackOverflow.append(jit.branchPtr(CCallHelpers::LessThanOrEqual, GPRInfo::regWS1, CCallHelpers::Address(GPRInfo::wasmContextInstancePointer, JSWebAssemblyInstance::offsetOfSoftStackLimit())));
> + 
> +         jit.move(GPRInfo::regWS1, CCallHelpers::stackPointerRegister);
> +-        jit.move(CCallHelpers::stackPointerRegister, GPRInfo::argumentGPR0);
> +-
> +-        jit.storePtr(GPRInfo::wasmContextInstancePointer, CCallHelpers::addressFor(CallFrameSlot::codeBlock));
> +-
> +-        // Save the current Callee before putting in our boxed callee for the stack visitor
> +-#if USE(JSVALUE64)
> +-        jit.loadPtr(CCallHelpers::addressFor(CallFrameSlot::callee), GPRInfo::wasmBaseMemoryPointer);
> +-        jit.transferPtr(CCallHelpers::Address(GPRInfo::regWS0, WebAssemblyFunction::offsetOfBoxedJSToWasmCallee()), CCallHelpers::addressFor(CallFrameSlot::callee));
> +-#else
> +-        jit.loadPtr(CCallHelpers::addressFor(CallFrameSlot::callee), GPRInfo::regWS1);
> +-        jit.push(GPRInfo::regWS1);
> +-        jit.push(GPRInfo::regWS1);
> +-        jit.transferPtr(CCallHelpers::Address(GPRInfo::regWS0, WebAssemblyFunction::offsetOfBoxedJSToWasmCallee()), CCallHelpers::addressFor(CallFrameSlot::callee));
> +-#endif
> + 
> +         // Prepare frame
> +-        jit.setupArguments<decltype(operationJSToWasmEntryWrapperBuildFrame)>(GPRInfo::argumentGPR0, GPRInfo::callFrameRegister, GPRInfo::regWS0);
> ++        jit.setupArguments<decltype(operationJSToWasmEntryWrapperBuildFrame)>(CCallHelpers::stackPointerRegister, GPRInfo::callFrameRegister, GPRInfo::regWS0);
> +         jit.callOperation<OperationPtrTag>(operationJSToWasmEntryWrapperBuildFrame);
> +-
> +-        // Restore Callee slot regardless
> +-#if USE(JSVALUE64)
> +-        jit.storePtr(GPRInfo::wasmBaseMemoryPointer, CCallHelpers::addressFor(CallFrameSlot::callee));
> +-#else
> +-        jit.transferPtr(CCallHelpers::Address(CCallHelpers::stackPointerRegister, 0), CCallHelpers::addressFor(CallFrameSlot::callee));
> +-        jit.addPtr(CCallHelpers::TrustedImm32(2 * 8), CCallHelpers::stackPointerRegister);
> +-#endif
> +-
> +         static_assert(CCallHelpers::operationExceptionRegister<operationJSToWasmEntryWrapperBuildFrame>() != InvalidGPRReg, "We don't have a VM readily available so we rely on exception being returned");
> +         JIT_COMMENT(jit, "Exception check: ", CCallHelpers::operationExceptionRegister<operationJSToWasmEntryWrapperBuildFrame>());
> +         buildEntryFrameThrew.append(jit.branchTestPtr(CCallHelpers::NonZero, CCallHelpers::operationExceptionRegister<operationJSToWasmEntryWrapperBuildFrame>()));
> +         jit.move(GPRInfo::returnValueGPR, GPRInfo::regWS0);
> + 
> +-        // Memory
> +-#if USE(JSVALUE64)
> +-        jit.loadPair64(GPRInfo::wasmContextInstancePointer, CCallHelpers::TrustedImm32(JSWebAssemblyInstance::offsetOfCachedMemory()), GPRInfo::wasmBaseMemoryPointer, GPRInfo::wasmBoundsCheckingSizeRegister);
> +-        jit.cageConditionally(Gigacage::Primitive, GPRInfo::wasmBaseMemoryPointer, GPRInfo::wasmBoundsCheckingSizeRegister, GPRInfo::regWA0);
> +-#endif
> +-
> + #if CPU(ARM64)
> +         jit.loadPair64(CCallHelpers::Address(CCallHelpers::stackPointerRegister, 0 * 8), GPRInfo::regWA0, GPRInfo::regWA1);
> +         jit.loadPair64(CCallHelpers::Address(CCallHelpers::stackPointerRegister, 2 * 8), GPRInfo::regWA2, GPRInfo::regWA3);
> diff --git a/meta/recipes-sato/webkit/webkitgtk_2.48.5.bb b/meta/recipes-sato/webkit/webkitgtk_2.48.5.bb
> index 947996450d..1fa735e06e 100644
> --- a/meta/recipes-sato/webkit/webkitgtk_2.48.5.bb
> +++ b/meta/recipes-sato/webkit/webkitgtk_2.48.5.bb
> @@ -19,6 +19,9 @@ SRC_URI = "https://www.webkitgtk.org/releases/${BPN}-${PV}.tar.xz \
>             file://0001-Fix-build-errors-on-RISCV-https-bugs.webkit.org-show.patch \
>             file://fix-ftbfs-riscv64.patch \
>             "
> +SRC_URI:append:arm = "file://0001-Revert-Cherry-pick-289651.534-safari-7621-branch-a8d.patch"
> +SRC_URI:append:armeb = "file://0001-Revert-Cherry-pick-289651.534-safari-7621-branch-a8d.patch"
> +
>  SRC_URI[sha256sum] = "bb64ed9d1cfd58e8b5e89ccad71dd31adfed56336bad7695031ad0b668e1987c"
>  
>  inherit cmake pkgconfig gobject-introspection perlnative features_check upstream-version-is-even gi-docgen
diff mbox series

Patch

diff --git a/meta/recipes-sato/webkit/webkitgtk/0001-Revert-Cherry-pick-289651.534-safari-7621-branch-a8d.patch b/meta/recipes-sato/webkit/webkitgtk/0001-Revert-Cherry-pick-289651.534-safari-7621-branch-a8d.patch
new file mode 100644
index 0000000000..1dc4dc7b69
--- /dev/null
+++ b/meta/recipes-sato/webkit/webkitgtk/0001-Revert-Cherry-pick-289651.534-safari-7621-branch-a8d.patch
@@ -0,0 +1,160 @@ 
+From 35e52b719635a004e19726674fd03b4bb3d8f043 Mon Sep 17 00:00:00 2001
+From: Gyorgy Sarvari <skandigraun@gmail.com>
+Date: Thu, 7 Aug 2025 18:02:37 +0200
+Subject: [PATCH] Revert "Cherry-pick 289651.534@safari-7621-branch
+ (a8d546461042). https://bugs.webkit.org/show_bug.cgi?id=292621"
+
+This commit causes a build failure on 32-bit arm:
+webkitgtk-2.48.5/Source/JavaScriptCore/offlineasm/ast.rb:1004:in 'Instruction#lowerDefault': Unhandled opcode addq at WebAssembly.asm:739 (due to WebAssembly.asm:739) (LoweringError)
+
+The reverted commit[1] is fixing a potential undefined behavior due
+to uninitialized memory content, which, by looking at the code, has been present 
+since 08.2024. (The commit references a bugreport which requires elevated access 
+rights, so no details are available)
+
+[1]: https://github.com/WebKit/WebKit/commit/846b3f034f0021a0e45358b904682bc3de367605
+
+Upstream-Status: Inappropriate [cross-compiling workaround. bugreport: https://bugs.webkit.org/show_bug.cgi?id=297062]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ Source/JavaScriptCore/llint/WebAssembly.asm | 49 +++++----------------
+ Source/JavaScriptCore/wasm/js/JSToWasm.cpp  | 36 +++------------
+ 2 files changed, 18 insertions(+), 67 deletions(-)
+
+diff --git a/Source/JavaScriptCore/llint/WebAssembly.asm b/Source/JavaScriptCore/llint/WebAssembly.asm
+index 1ac3e2accf3c..754909f8c63e 100644
+--- a/Source/JavaScriptCore/llint/WebAssembly.asm
++++ b/Source/JavaScriptCore/llint/WebAssembly.asm
+@@ -692,6 +692,17 @@ end
+     loadp Callee[cfr], ws0 # WebAssemblyFunction*
+     loadp WebAssemblyFunction::m_instance[ws0], wasmInstance
+ 
++    # Memory
++    if ARM64 or ARM64E
++        loadpairq JSWebAssemblyInstance::m_cachedMemory[wasmInstance], memoryBase, boundsCheckingSize
++    elsif X86_64
++        loadp JSWebAssemblyInstance::m_cachedMemory[wasmInstance], memoryBase
++        loadp JSWebAssemblyInstance::m_cachedBoundsCheckingSize[wasmInstance], boundsCheckingSize
++    end
++    if not ARMv7
++        cagedPrimitiveMayBeNull(memoryBase, wa0)
++    end
++
+     # Allocate stack space
+     loadi WebAssemblyFunction::m_frameSize[ws0], wa0
+     subp sp, wa0, wa0
+@@ -709,51 +720,15 @@ if ASSERT_ENABLED
+     end)
+ end
+ 
+-    # a0 = current stack frame position
+-    move sp, a0
+-
+-    # Save wasmInstance and put the correct Callee into the stack for building the frame
+-    storep wasmInstance, CodeBlock[cfr]
+-
+-if JSVALUE64
+-    loadp Callee[cfr], memoryBase
+-    transferp WebAssemblyFunction::m_boxedJSToWasmCallee[ws0], Callee[cfr]
+-else
+-    # Store old Callee to the stack temporarily
+-    loadp Callee[cfr], ws1
+-    push ws1, ws1
+-    loadp WebAssemblyFunction::m_boxedJSToWasmCallee[ws0], ws1
+-    storep ws1, Callee[cfr]
+-end
+-
+     # Prepare frame
+     move ws0, a2
+     move cfr, a1
++    move sp, a0
+     cCall3(_operationJSToWasmEntryWrapperBuildFrame)
+ 
+-    # Restore Callee slot
+-if JSVALUE64
+-    storep memoryBase, Callee[cfr]
+-else
+-    loadp [sp], ws0
+-    addq 2 * SlotSize, sp
+-    storep ws0, Callee[cfr]
+-end
+-
+     btpnz r1, .buildEntryFrameThrew
+     move r0, ws0
+ 
+-    # Memory
+-    if ARM64 or ARM64E
+-        loadpairq JSWebAssemblyInstance::m_cachedMemory[wasmInstance], memoryBase, boundsCheckingSize
+-    elsif X86_64
+-        loadp JSWebAssemblyInstance::m_cachedMemory[wasmInstance], memoryBase
+-        loadp JSWebAssemblyInstance::m_cachedBoundsCheckingSize[wasmInstance], boundsCheckingSize
+-    end
+-    if not ARMv7
+-        cagedPrimitiveMayBeNull(memoryBase, wa0)
+-    end
+-
+     # Arguments
+ 
+ if ARM64 or ARM64E
+diff --git a/Source/JavaScriptCore/wasm/js/JSToWasm.cpp b/Source/JavaScriptCore/wasm/js/JSToWasm.cpp
+index 10f0771538e6..812b9ae70af3 100644
+--- a/Source/JavaScriptCore/wasm/js/JSToWasm.cpp
++++ b/Source/JavaScriptCore/wasm/js/JSToWasm.cpp
+@@ -241,6 +241,11 @@ MacroAssemblerCodeRef<JITThunkPtrTag> createJSToWasmJITShared()
+ 
+         jit.loadPtr(CCallHelpers::addressFor(CallFrameSlot::callee), GPRInfo::regWS0);
+         jit.loadPtr(CCallHelpers::Address(GPRInfo::regWS0, WebAssemblyFunction::offsetOfInstance()), GPRInfo::wasmContextInstancePointer);
++        // Memory
++#if USE(JSVALUE64)
++        jit.loadPair64(GPRInfo::wasmContextInstancePointer, CCallHelpers::TrustedImm32(JSWebAssemblyInstance::offsetOfCachedMemory()), GPRInfo::wasmBaseMemoryPointer, GPRInfo::wasmBoundsCheckingSizeRegister);
++        jit.cageConditionally(Gigacage::Primitive, GPRInfo::wasmBaseMemoryPointer, GPRInfo::wasmBoundsCheckingSizeRegister, GPRInfo::regWA0);
++#endif
+ 
+         // Now, the current frame is fully set up for exceptions.
+         // Allocate stack space
+@@ -254,44 +259,15 @@ MacroAssemblerCodeRef<JITThunkPtrTag> createJSToWasmJITShared()
+         stackOverflow.append(jit.branchPtr(CCallHelpers::LessThanOrEqual, GPRInfo::regWS1, CCallHelpers::Address(GPRInfo::wasmContextInstancePointer, JSWebAssemblyInstance::offsetOfSoftStackLimit())));
+ 
+         jit.move(GPRInfo::regWS1, CCallHelpers::stackPointerRegister);
+-        jit.move(CCallHelpers::stackPointerRegister, GPRInfo::argumentGPR0);
+-
+-        jit.storePtr(GPRInfo::wasmContextInstancePointer, CCallHelpers::addressFor(CallFrameSlot::codeBlock));
+-
+-        // Save the current Callee before putting in our boxed callee for the stack visitor
+-#if USE(JSVALUE64)
+-        jit.loadPtr(CCallHelpers::addressFor(CallFrameSlot::callee), GPRInfo::wasmBaseMemoryPointer);
+-        jit.transferPtr(CCallHelpers::Address(GPRInfo::regWS0, WebAssemblyFunction::offsetOfBoxedJSToWasmCallee()), CCallHelpers::addressFor(CallFrameSlot::callee));
+-#else
+-        jit.loadPtr(CCallHelpers::addressFor(CallFrameSlot::callee), GPRInfo::regWS1);
+-        jit.push(GPRInfo::regWS1);
+-        jit.push(GPRInfo::regWS1);
+-        jit.transferPtr(CCallHelpers::Address(GPRInfo::regWS0, WebAssemblyFunction::offsetOfBoxedJSToWasmCallee()), CCallHelpers::addressFor(CallFrameSlot::callee));
+-#endif
+ 
+         // Prepare frame
+-        jit.setupArguments<decltype(operationJSToWasmEntryWrapperBuildFrame)>(GPRInfo::argumentGPR0, GPRInfo::callFrameRegister, GPRInfo::regWS0);
++        jit.setupArguments<decltype(operationJSToWasmEntryWrapperBuildFrame)>(CCallHelpers::stackPointerRegister, GPRInfo::callFrameRegister, GPRInfo::regWS0);
+         jit.callOperation<OperationPtrTag>(operationJSToWasmEntryWrapperBuildFrame);
+-
+-        // Restore Callee slot regardless
+-#if USE(JSVALUE64)
+-        jit.storePtr(GPRInfo::wasmBaseMemoryPointer, CCallHelpers::addressFor(CallFrameSlot::callee));
+-#else
+-        jit.transferPtr(CCallHelpers::Address(CCallHelpers::stackPointerRegister, 0), CCallHelpers::addressFor(CallFrameSlot::callee));
+-        jit.addPtr(CCallHelpers::TrustedImm32(2 * 8), CCallHelpers::stackPointerRegister);
+-#endif
+-
+         static_assert(CCallHelpers::operationExceptionRegister<operationJSToWasmEntryWrapperBuildFrame>() != InvalidGPRReg, "We don't have a VM readily available so we rely on exception being returned");
+         JIT_COMMENT(jit, "Exception check: ", CCallHelpers::operationExceptionRegister<operationJSToWasmEntryWrapperBuildFrame>());
+         buildEntryFrameThrew.append(jit.branchTestPtr(CCallHelpers::NonZero, CCallHelpers::operationExceptionRegister<operationJSToWasmEntryWrapperBuildFrame>()));
+         jit.move(GPRInfo::returnValueGPR, GPRInfo::regWS0);
+ 
+-        // Memory
+-#if USE(JSVALUE64)
+-        jit.loadPair64(GPRInfo::wasmContextInstancePointer, CCallHelpers::TrustedImm32(JSWebAssemblyInstance::offsetOfCachedMemory()), GPRInfo::wasmBaseMemoryPointer, GPRInfo::wasmBoundsCheckingSizeRegister);
+-        jit.cageConditionally(Gigacage::Primitive, GPRInfo::wasmBaseMemoryPointer, GPRInfo::wasmBoundsCheckingSizeRegister, GPRInfo::regWA0);
+-#endif
+-
+ #if CPU(ARM64)
+         jit.loadPair64(CCallHelpers::Address(CCallHelpers::stackPointerRegister, 0 * 8), GPRInfo::regWA0, GPRInfo::regWA1);
+         jit.loadPair64(CCallHelpers::Address(CCallHelpers::stackPointerRegister, 2 * 8), GPRInfo::regWA2, GPRInfo::regWA3);
diff --git a/meta/recipes-sato/webkit/webkitgtk_2.48.5.bb b/meta/recipes-sato/webkit/webkitgtk_2.48.5.bb
index 947996450d..1fa735e06e 100644
--- a/meta/recipes-sato/webkit/webkitgtk_2.48.5.bb
+++ b/meta/recipes-sato/webkit/webkitgtk_2.48.5.bb
@@ -19,6 +19,9 @@  SRC_URI = "https://www.webkitgtk.org/releases/${BPN}-${PV}.tar.xz \
            file://0001-Fix-build-errors-on-RISCV-https-bugs.webkit.org-show.patch \
            file://fix-ftbfs-riscv64.patch \
            "
+SRC_URI:append:arm = "file://0001-Revert-Cherry-pick-289651.534-safari-7621-branch-a8d.patch"
+SRC_URI:append:armeb = "file://0001-Revert-Cherry-pick-289651.534-safari-7621-branch-a8d.patch"
+
 SRC_URI[sha256sum] = "bb64ed9d1cfd58e8b5e89ccad71dd31adfed56336bad7695031ad0b668e1987c"
 
 inherit cmake pkgconfig gobject-introspection perlnative features_check upstream-version-is-even gi-docgen