Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 0d6fe1662d2de50ca7f91db10a75541c19bf178d
https://github.com/WebKit/WebKit/commit/0d6fe1662d2de50ca7f91db10a75541c19bf178d
Author: Kai Tamkun <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A JSTests/stress/spread-with-OnlyAtomStringsStructure.js
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
Log Message:
-----------
[JSC] Spread operator doesn't account for
cellButterflyOnlyAtomStringsStructure in DFG
https://bugs.webkit.org/show_bug.cgi?id=313252
rdar://175498631
Reviewed by Yijia Huang.
This patch fixes the abstract interpreter's structure prediction for the spread
operator.
Instead of only cellButterflyStructure(CopyOnWriteArrayWithContiguous), it now
also takes
cellButterflyOnlyAtomStringsStructure into account.
Test: JSTests/stress/spread-with-OnlyAtomStringsStructure.js
* JSTests/stress/spread-with-OnlyAtomStringsStructure.js: Added.
(index):
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
Originally-landed-as: 305413.768@safari-7624-branch (62a1052dd1fe).
rdar://180435430
Canonical link: https://commits.webkit.org/316128@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
