Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c3ca56b3af803be584aad6498beab4fec68b6a1e
https://github.com/WebKit/WebKit/commit/c3ca56b3af803be584aad6498beab4fec68b6a1e
Author: Vassili Bykov <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A JSTests/stress/arguments-elimination-multiple-inline-call-frames.js
M Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp
Log Message:
-----------
[JSC] DFGArgumentsEliminationPhase removeViaKill should reset node scan index
between InlineCallFrames
https://bugs.webkit.org/show_bug.cgi?id=314850
rdar://176966728
Reviewed by Yusuke Suzuki.
In DFGArgumentsEliminationPhase::eliminateCandidatesThatInterfere(), the
removeViaKill
lambda contains two nested loops. The outer loop iterates over inline call
frames. For
each frame, the inner loop is expected to iterate the nodes of the given basic
block in
reverse order in the range [0, nodeIndex). However, because the inner loop
mutates the
lambda parameter nodeIndex directly, this only works as intended for the first
inline call
frame. Each subsequent call frame begins where the previous one left off.
The change introduces a separate iteration variable for the inner loop, which
starts off
at nodeIndex for each inline call frame. nodeIndex parameter is marked as
'const' to make
explicit the expectation that it should not change.
Test: JSTests/stress/arguments-elimination-multiple-inline-call-frames.js
Originally-landed-as: 305413.912@safari-7624-branch (3270ebdb7366).
rdar://180435783
Canonical link: https://commits.webkit.org/316118@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
