Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 1d5c10e2f9c8f31378c8b14fb71a48423793ce07
https://github.com/WebKit/WebKit/commit/1d5c10e2f9c8f31378c8b14fb71a48423793ce07
Author: Dan Hecht <[email protected]>
Date: 2026-08-24 (Mon, 24 Aug 2026)
Changed paths:
M Source/JavaScriptCore/b3/B3PureCSE.cpp
M Source/JavaScriptCore/b3/B3PureCSE.h
M Source/JavaScriptCore/b3/B3ReduceStrength.cpp
M Source/JavaScriptCore/b3/testb3.h
M Source/JavaScriptCore/b3/testb3_1.cpp
M Source/JavaScriptCore/b3/testb3_6.cpp
Log Message:
-----------
[JSC] Fix B3 ReduceStrength Select specialization when a Check appears
between the Select and triggering Check
https://bugs.webkit.org/show_bug.cgi?id=316347
rdar://177687354
Reviewed by Marcus Plutowski.
In B3ReduceStrength, specializeSelect() specializes a Select that has a constant
arm and is reached, within selectSpecializationBound, from a Check: it splits
the
block at the Check, clones the values between the Select and the Check into the
then/else arms, and deleteValue()s the Void ones in that range.
PureCSE records pure Values in a per-iteration map (m_pureCSE) and assumes they
stay present. Checks, though Void, are also recorded (to enable removing
redundant
Branches), so an intermediate Check in that range is recorded too;
specializeSelect
then deleteValue()s it without updating the map.
Keep the map consistent: remove the value from m_pureCSE before specializeSelect
deletes it.
Tests: Source/JavaScriptCore/b3/testb3_1.cpp
Source/JavaScriptCore/b3/testb3_6.cpp
* Source/JavaScriptCore/b3/B3PureCSE.cpp:
(JSC::B3::PureCSE::clear):
(JSC::B3::PureCSE::remove):
* Source/JavaScriptCore/b3/B3PureCSE.h:
* Source/JavaScriptCore/b3/B3ReduceStrength.cpp:
* Source/JavaScriptCore/b3/testb3.h:
* Source/JavaScriptCore/b3/testb3_1.cpp:
(run):
* Source/JavaScriptCore/b3/testb3_6.cpp:
(testCheckSelectAndDeadCheckCSE):
Originally-landed-as: [email protected] (353f0e1145bf).
rdar://185369088
Canonical link: https://commits.webkit.org/319718@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
