Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 7f36028faf14865063b1025b190d7bf0a4553eb3
https://github.com/WebKit/WebKit/commit/7f36028faf14865063b1025b190d7bf0a4553eb3
Author: Yijia Huang <[email protected]>
Date: 2026-06-27 (Sat, 27 Jun 2026)
Changed paths:
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
Log Message:
-----------
[JSC][DFG] Widen GetByVal prediction to SpecBytecodeTop instead of forcing
OSR exit when value profile is empty
https://bugs.webkit.org/show_bug.cgi?id=318018
rdar://180818044
Reviewed by Yusuke Suzuki.
FixupPhase currently inserts a ForceOSRExit before a GetByVal whose value
profile produced no prediction. This is over-conservative: the resulting DFG
plan exits whenever control reaches the GetByVal site, gets jettisoned, and
tends to be recompiled with the same defect on subsequent attempts.
Set the prediction to SpecBytecodeTop instead. DFG generates code that
handles any
JSValue type, and downstream nodes still apply their own
speculations via edge UseKinds — so a localized OSR exit only fires when
the actual runtime type mismatches a downstream node's expectation.
SpecBytecodeTop is the established "any type" fallback elsewhere in the
DFG: DFGPredictionPropagationPhase uses it for WeakMapGet,
ResolveScopeForHoistingFuncDeclInEval, and GetCellButterflySlot in non-Int32
array modes.
Canonical link:
https://flagged.apple.com:443/proxy?t2=DH4C1a5RJ8&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE1OTc2QG1haW4=&emid=0733d6f2-c537-457b-b39d-38f1256737a0&c=11
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
