Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: bf1915b95bd382bc5c1b714b78e9c9ab24ffb0b5
https://github.com/WebKit/WebKit/commit/bf1915b95bd382bc5c1b714b78e9c9ab24ffb0b5
Author: Sosuke Suzuki <[email protected]>
Date: 2026-06-29 (Mon, 29 Jun 2026)
Changed paths:
A JSTests/stress/promise-prototype-catch-on-non-promise.js
A JSTests/stress/regexp-prototype-symbol-search-on-non-regexp.js
A JSTests/stress/regexp-prototype-test-on-non-regexp.js
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
Log Message:
-----------
[JSC] Add missing exit-profile bails to some DFG nodes
https://bugs.webkit.org/show_bug.cgi?id=318089
Reviewed by Yusuke Suzuki.
RegExpSearchIntrinsic, RegExpTestIntrinsic, and PromisePrototypeCatchIntrinsic
guard the receiver with Check(RegExpObjectUse / PromiseObjectUse) but never
consult the BadType exit profile, unlike their siblings (RegExpMatchIntrinsic,
RegExpSplitIntrinsic, PromisePrototypeThenIntrinsic).
Tests: JSTests/stress/promise-prototype-catch-on-non-promise.js
JSTests/stress/regexp-prototype-symbol-search-on-non-regexp.js
JSTests/stress/regexp-prototype-test-on-non-regexp.js
* JSTests/stress/promise-prototype-catch-on-non-promise.js: Added.
(callCatch):
(fake.then):
* JSTests/stress/regexp-prototype-symbol-search-on-non-regexp.js: Added.
(search):
(fake.exec):
* JSTests/stress/regexp-prototype-test-on-non-regexp.js: Added.
(test):
(fake.exec):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
Canonical link: https://commits.webkit.org/316013@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
