Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 91d96b29d6b286a0355782507d61298d39146083
https://github.com/WebKit/WebKit/commit/91d96b29d6b286a0355782507d61298d39146083
Author: Sosuke Suzuki <[email protected]>
Date: 2026-08-04 (Tue, 04 Aug 2026)
Changed paths:
A JSTests/stress/string-iterator-next-intrinsic-with-structure-transition.js
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGLICMPhase.cpp
M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
Log Message:
-----------
[JSC] `AbstractInterpreter::forAllValues` should handle tuple nodes
https://bugs.webkit.org/show_bug.cgi?id=320948
Reviewed by Yusuke Suzuki.
315180@main inlines StringIteratorPrototype.next into DFG, which places the
StringIteratorNextWithUndefined tuple node into an ordinary straight-line block.
When a later node in the same block causes a structure transition,
observeTransition() calls forAllValues(), which invoked forNode() on the tuple
node and hit ASSERT(!node->isTuple()). Existing tuple nodes never triggered this
because they only appear in for-of / for-in header blocks, away from arbitrary
user code.
for (let i = 0; i < 3e5; i++) { ""[Symbol.iterator]().next(); var o = {};
o.k = i; }
This makes forAllValues() apply the functor to each tuple element instead. Tuple
nodes in liveAtHead are skipped since tuple abstract values are not propagated
across blocks (endBasicBlock / merge already ignore them).
AbstractInterpreter::dump() and safeToExecute()'s SafeToExecuteEdge had the same
problem, so --verboseCFA=1 asserted on any tuple node. dump() now prints each
tuple
element as @N<<index, and SafeToExecuteEdge consults forTupleNode() for the
ExtractFromTuple tuple child. LICM no longer needs to reject ExtractFromTuple up
front for that reason.
Test: JSTests/stress/string-iterator-next-intrinsic-with-structure-transition.js
* JSTests/stress/string-iterator-next-intrinsic-with-structure-transition.js:
Added.
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::forAllValues):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::dump):
* Source/JavaScriptCore/dfg/DFGLICMPhase.cpp:
(JSC::DFG::LICMPhase::attemptHoist):
* Source/JavaScriptCore/dfg/DFGSafeToExecute.h:
(JSC::DFG::SafeToExecuteEdge::operator()):
Canonical link: https://commits.webkit.org/318541@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
