Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: f24db23749f4549857680d70e77cbe9e4c7e7a52
https://github.com/WebKit/WebKit/commit/f24db23749f4549857680d70e77cbe9e4c7e7a52
Author: Yusuke Suzuki <ysuz...@apple.com>
Date: 2025-09-17 (Wed, 17 Sep 2025)
Changed paths:
A JSTests/stress/invalidate-state-based-on-edge-filter-result.js
M Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGAtTailAbstractState.h
M Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.h
Log Message:
-----------
[JSC] DFG ASSERTION FAILED: Generating OSR exit while node says DoesNotExit
https://bugs.webkit.org/show_bug.cgi?id=298850
rdar://160593061
Reviewed by Justin Michaud.
This is not an actual issue because this happens only when the input is
already None. This means that we will never reach here at runtime. So
whether we generate OSR exit code or not does not matter. But let's make
this verification correct by making abstract state invalid when edge
filtering contradicts.
Test: JSTests/stress/invalidate-state-based-on-edge-filter-result.js
Test: JSTests/stress/invalidate-state-based-on-edge-filter-result.js
* JSTests/stress/invalidate-state-based-on-edge-filter-result.js: Added.
(foo):
* Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h:
(JSC::DFG::AbstractInterpreter::filterEdgeByUse):
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEdges):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeKnownEdgeTypes):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::filterByType):
(JSC::DFG::AbstractInterpreterExecuteEdgesFunc::AbstractInterpreterExecuteEdgesFunc):
Deleted.
(JSC::DFG::AbstractInterpreterExecuteEdgesFunc::operator() const): Deleted.
* Source/JavaScriptCore/dfg/DFGAtTailAbstractState.h:
(JSC::DFG::AtTailAbstractState::fastForwardAndFilterUnproven):
* Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.h:
(JSC::DFG::InPlaceAbstractState::fastForwardAndFilterUnproven):
Canonical link: https://commits.webkit.org/300085@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
