Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 3ddc7045b7c5a9ccb6ef09124c7b8efb93527208
https://github.com/WebKit/WebKit/commit/3ddc7045b7c5a9ccb6ef09124c7b8efb93527208
Author: Tadeu Zagallo <[email protected]>
Date: 2026-08-19 (Wed, 19 Aug 2026)
Changed paths:
A JSTests/stress/switch-char-scrutinee-live-at-osr-exit.js
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
Log Message:
-----------
[JSC] DFG SwitchChar releases its operand before speculating that it is a
string
https://bugs.webkit.org/show_bug.cgi?id=322101
rdar://183337191
Reviewed by Yusuke Suzuki.
emitSwitchChar()'s StringUse case called op1.use() before speculateString(), so
the operand's death event preceded the BadType exit in the variable event
stream.
Reconstruction then handed out a dead-value recovery for every bytecode local
whose MovHint pointed at that node (here the scrutinee temporary, whose
SetLocal the DFG had eliminated) and baseline re-executed op_switch_char on it.
Speculate before releasing the operand, as emitSwitchString() already does.
Test: JSTests/stress/switch-char-scrutinee-live-at-osr-exit.js
* JSTests/stress/switch-char-scrutinee-live-at-osr-exit.js: Added.
(opt.switch.case.string_appeared_here):
(opt):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::emitSwitchChar):
Canonical link: https://commits.webkit.org/319462@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
