Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 932597e5d40b77054581eea065f8b169e9f4fd3f
https://github.com/WebKit/WebKit/commit/932597e5d40b77054581eea065f8b169e9f4fd3f
Author: Yusuke Suzuki <[email protected]>
Date: 2025-04-05 (Sat, 05 Apr 2025)
Changed paths:
M Source/JavaScriptCore/dfg/DFGClobberize.h
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Log Message:
-----------
[JSC] Should not perform MultiGetByVal CSE when underlying TypedArray's
backing store is resizable
https://bugs.webkit.org/show_bug.cgi?id=291128
rdar://problem/148664737
Reviewed by Sosuke Suzuki.
We should not allow CSE for MultiGetByVal when it is accepting resizable
TypedArrays since resizing can make base+index result different. We also
need to have OutOfBounds speculation for InBounds case in TypedArrays.
This is tested via JSTests/stress/v8-typedarray-resizablearraybuffer.js.
* Source/JavaScriptCore/dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
Canonical link: https://commits.webkit.org/293322@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
