Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ae69ef2312c05f2d4e25f77e4bbaeaf249e2f1e4
https://github.com/WebKit/WebKit/commit/ae69ef2312c05f2d4e25f77e4bbaeaf249e2f1e4
Author: Yusuke Suzuki <[email protected]>
Date: 2026-06-17 (Wed, 17 Jun 2026)
Changed paths:
A JSTests/stress/array-iterator-fast-entries-double-array-fixup-exit-ok.js
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
Log Message:
-----------
[JSC] "entries" ArrayIterator should emit ExitOK before NewArray
https://bugs.webkit.org/show_bug.cgi?id=317327
rdar://179702753
Reviewed by Marcus Plutowski.
In "entries" ArrayIterator, we do GetByVal, and then we do NewArray for
the result. But GetByVal can perform OSR exit, and NewArray can raise
OOM error, and OSR exit. This makes Fixup phase confused and emitting
ValueRep at a wrong position. Emit ExitOK before NewArray. This is fine
since these GetByVal and NewArray are non-user-observable (except for
OOM, which is fine).
Test: JSTests/stress/array-iterator-fast-entries-double-array-fixup-exit-ok.js
* JSTests/stress/array-iterator-fast-entries-double-array-fixup-exit-ok.js:
Added.
(inner):
(driver):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::inlineCall):
(JSC::DFG::ByteCodeParser::handleInlining):
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
(JSC::DFG::ByteCodeParser::handleIntrinsicGetter):
(JSC::DFG::ByteCodeParser::emitProxyObjectLoadCall):
(JSC::DFG::ByteCodeParser::emitProxyObjectStoreCall):
(JSC::DFG::ByteCodeParser::emitProxyObjectInCall):
(JSC::DFG::ByteCodeParser::handleGetById):
(JSC::DFG::ByteCodeParser::handlePutById):
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::handleIteratorOpen):
(JSC::DFG::ByteCodeParser::handleIteratorNext):
Canonical link: https://commits.webkit.org/315411@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
