Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 7920db18a51b134b3e7aef9d58cc32626bc0ffd6
https://github.com/WebKit/WebKit/commit/7920db18a51b134b3e7aef9d58cc32626bc0ffd6
Author: Dan Hecht <[email protected]>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
A JSTests/stress/operation-polymorphic-call-host-call-ic-reset.js
M Source/JavaScriptCore/bytecode/RepatchInlines.h
M Source/JavaScriptCore/jit/JITOperations.cpp
M Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
Log Message:
-----------
[JSC] Do not attempt to link a CallLinkInfo after handleHostCall
https://bugs.webkit.org/show_bug.cgi?id=317142
rdar://178282225
Reviewed by Yusuke Suzuki.
handleHostCall performs the host call which may execute JS that
fires a watchpoint invalidating the passed CallLinkInfo. So,
it's not safe to modify *CallLinkInfo after the host call.
So, make the callers of virtualForWithFunction skip the
linkPolymorphicCall call in this case. This aligns the behavior
of operationPolymorphicCall / llint_polymorphic_call with linkFor.
However, to avoid the InternalFunction case potentially getting
stuck in the polymorphic mode slow path, return the JSCell in this case.
This is a slight change in behavior: before this change,
InternalFunction would have caused the CallLinkInfo to downgrade
to virtual mode. With this change, it can remain in polymorphic
mode. This also aligns with linkFor behavior.
Test: JSTests/stress/operation-polymorphic-call-host-call-ic-reset.js
* JSTests/stress/operation-polymorphic-call-host-call-ic-reset.js: Added.
(g2):
(g3):
(getP):
(evil.new.Proxy):
(evil.new.Proxy.apply):
* Source/JavaScriptCore/bytecode/RepatchInlines.h:
(JSC::virtualForWithFunction):
* Source/JavaScriptCore/jit/JITOperations.cpp:
(JSC::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:
(JSC::LLInt::llint_polymorphic_call):
Originally-landed-as: [email protected] (09ca909b6a83).
rdar://185366736
Canonical link: https://commits.webkit.org/319817@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
