Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: cb05a6083ae0246da0eeee815a7ba5daf3b20c25
https://github.com/WebKit/WebKit/commit/cb05a6083ae0246da0eeee815a7ba5daf3b20c25
Author: Shu-yu Guo <[email protected]>
Date: 2026-08-24 (Mon, 24 Aug 2026)
Changed paths:
A JSTests/stress/dfg-getscope-fold-stale-cfa-state.js
M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
Log Message:
-----------
[JSC] Refresh AI state when folding GetScope to Identity
https://bugs.webkit.org/show_bug.cgi?id=316803
rdar://178423757
Reviewed by Yusuke Suzuki.
A GetScope could be constant folded to Identity. When this happens, the
abstract interpreter isn't re-executed on the Identity node. If a previous run
of the AI left the abstract value corresponding to the pre-replacement GetScope
node as bottom, this stale bottom value can cause downstream consumers to
assume the Identity is unreachable when it is.
This PR re-executes
AI after folding to Identity.
Test: JSTests/stress/dfg-getscope-fold-stale-cfa-state.js
* JSTests/stress/dfg-getscope-fold-stale-cfa-state.js: Added.
(try.Trans):
(try.inline):
(foo):
(C):
(opt):
(i.catch):
* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
Originally-landed-as: [email protected] (3efb180e50d2).
rdar://185369111
Canonical link:
https://flagged.apple.com:443/proxy?t2=Da7x8s2GT1&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE5NzE5QG1haW4=&emid=6223e5f0-34cf-44db-8863-4fd500f8c57e&c=11
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
