Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 95b9bdf57cef88c958a1182e8a6a687e7ae8ccfa
https://github.com/WebKit/WebKit/commit/95b9bdf57cef88c958a1182e8a6a687e7ae8ccfa
Author: Sosuke Suzuki <[email protected]>
Date: 2026-07-04 (Sat, 04 Jul 2026)
Changed paths:
A JSTests/wasm/stress/streaming-compile-invalid-function-body.js
M Source/JavaScriptCore/wasm/WasmIPIntPlan.cpp
Log Message:
-----------
[Wasm] Don't move a failed streaming Wasm plan back to Compiled
https://bugs.webkit.org/show_bug.cgi?id=318411
Reviewed by Yusuke Suzuki.
When a function body fails validation during streaming compilation,
Plan::fail moves the plan to Completed on the worklist thread. The last
StreamingPlan's completion callback then unconditionally moved the plan
back to Compiled, breaking the monotonic state machine and hitting
"ASSERTION FAILED: state >= m_state" on assertion-enabled builds. Guard
the transition with hasWork(), as the non-streaming path already does.
* JSTests/wasm/stress/streaming-compile-invalid-function-body.js: Added.
* Source/JavaScriptCore/wasm/WasmIPIntPlan.cpp:
(JSC::Wasm::IPIntPlan::didCompileFunctionInStreaming):
Canonical link: https://commits.webkit.org/316510@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
