Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: a02f99629f76ee4bc721eb5f16a1bdf7286792c3
https://github.com/WebKit/WebKit/commit/a02f99629f76ee4bc721eb5f16a1bdf7286792c3
Author: Kai Tamkun <[email protected]>
Date: 2026-08-13 (Thu, 13 Aug 2026)
Changed paths:
A
JSTests/stress/ftl-osr-exit-materialize-phantom-array-with-live-butterfly.js
M Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
Log Message:
-----------
[JSC] FTL OSR exit: handle DataFormatStorage in reboxAccordingToFormat
https://bugs.webkit.org/show_bug.cgi?id=314579
rdar://176131036
Reviewed by Marcus Plutowski.
300523@main relaxed validation so that PhantomNewArrayWithButterfly may
reference a non-phantom NewButterflyWithSize, and taught
FTLLowerDFGToB3::exitValueForNode to emit an ExitArgument with
DataFormatStorage for the live butterfly. However, the FTL OSR exit
compiler's reboxAccordingToFormat() was never updated, so when such an
exit is compiled it falls into RELEASE_ASSERT_NOT_REACHED().
The recovered storage value is the raw butterfly pointer that
operationMaterializeObjectInOSR(PhantomNewArrayWithButterfly) consumes
via std::bit_cast<Butterfly*>, so no boxing is required; treat it the
same as DataFormatJS and pass it through unchanged.
Test:
JSTests/stress/ftl-osr-exit-materialize-phantom-array-with-live-butterfly.js
* JSTests/stress/ftl-osr-exit-materialize-phantom-array-with-live-butterfly.js:
Added.
(check):
(main.v2):
(main):
* Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp:
(JSC::FTL::reboxAccordingToFormat):
Originally-landed-as: [email protected] (883cc7576689).
rdar://184744946
Canonical link: https://commits.webkit.org/319094@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
