Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 1aeca6948c89d2765d32bb90315ab070cd5f333d
https://github.com/WebKit/WebKit/commit/1aeca6948c89d2765d32bb90315ab070cd5f333d
Author: Anand Srinivasan <[email protected]>
Date: 2026-05-20 (Wed, 20 May 2026)
Changed paths:
A JSTests/stress/array-sort-inline-ai-cell-butterfly-validation.js
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
Log Message:
-----------
DFG abstract interpreter misclassifies ArraySortCompact result as
SpecObjectOther
https://bugs.webkit.org/show_bug.cgi?id=315143
rdar://177361524
Reviewed by Yijia Huang.
ArraySortCompact returns a JSCellButterfly but DFG abstract interpreter marks
the node as SpecObjectOther instead of SpecCellOther even though a JSCell is
not necessarily a JSObject. This patch fixes the abstract interpreter to use
SpecCellOther.
Test: JSTests/stress/array-sort-inline-ai-cell-butterfly-validation.js
* JSTests/stress/array-sort-inline-ai-cell-butterfly-validation.js: Added.
(sortIt):
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:
Canonical link: https://commits.webkit.org/313587@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
