Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8f9d6d2b9c5f0ab9c31ff1f9f6fe42cbb67311d4
https://github.com/WebKit/WebKit/commit/8f9d6d2b9c5f0ab9c31ff1f9f6fe42cbb67311d4
Author: Yusuke Suzuki <[email protected]>
Date: 2024-06-06 (Thu, 06 Jun 2024)
Changed paths:
A JSTests/stress/ftl-uint32-array-out-of-bounds.js
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Log Message:
-----------
REGRESSION (iOS 17.5): Method call silently fails since iOS 17.5/ MacOS 14.5
after a warmup period
https://bugs.webkit.org/show_bug.cgi?id=275160
rdar://129303210
Reviewed by Yijia Huang and Keith Miller.
When FTL is handling OutOfBounds Uint32Array access, it should wrap the results
to double when we do not have speculations.
* JSTests/stress/ftl-uint32-array-out-of-bounds.js: Added.
(iter):
(globalThis.setInterval):
(setInterval):
(requestAnimationFrame):
(copyFromSrcToTgt):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileGetByValImpl):
Canonical link: https://commits.webkit.org/279790@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
