Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 34669c802f5846a6c5e887eac932c18e9e8a156b
https://github.com/WebKit/WebKit/commit/34669c802f5846a6c5e887eac932c18e9e8a156b
Author: Shu-yu Guo <[email protected]>
Date: 2026-05-29 (Fri, 29 May 2026)
Changed paths:
A JSTests/stress/dataview-bytelength-ic-stub-stack-desync.js
M Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp
Log Message:
-----------
[JSC] Move DataView null vector check in IC outside of register save/restore
https://bugs.webkit.org/show_bug.cgi?id=312218
rdar://174627873
Reviewed by Marcus Plutowski.
In the DataView byteLength getter IC, there is a null vector check which
executes before a preserveReusedRegistersByPushing, but jumps to a point before
restoreReusedRegistersByPopping. In other words, causing a misbalanced push and
pop of register state.
This PR fixes by making the null vector check jump to after the popping of
saved registers.
Test: JSTests/stress/dataview-bytelength-ic-stub-stack-desync.js
* JSTests/stress/dataview-bytelength-ic-stub-stack-desync.js: Added.
(hot):
* Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp:
(JSC::InlineCacheCompiler::emitIntrinsicGetter):
Originally-landed-as: 305413.668@safari-7624-branch (68274fa2f297).
rdar://176059143
Canonical link: https://commits.webkit.org/314134@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
