Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 346d9afedd9ed94dc7bc15593416369a8257d0ad
https://github.com/WebKit/WebKit/commit/346d9afedd9ed94dc7bc15593416369a8257d0ad
Author: Kai Tamkun <[email protected]>
Date: 2026-08-16 (Sun, 16 Aug 2026)
Changed paths:
A
JSTests/stress/ftl-osr-exit-materialize-phantom-array-with-live-butterfly.js
M Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
Log Message:
-----------
Cherry-pick [email protected] (883cc7576689).
https://bugs.webkit.org/show_bug.cgi?id=314579
[JSC] FTL OSR exit: handle DataFormatStorage in reboxAccordingToFormat
https://bugs.webkit.org/show_bug.cgi?id=314579
rdar://176131036
Reviewed by Marcus Plutowski.
300523@main relaxed validation so that PhantomNewArrayWithButterfly may
reference a non-phantom NewButterflyWithSize, and taught
FTLLowerDFGToB3::exitValueForNode to emit an ExitArgument with
DataFormatStorage for the live butterfly. However, the FTL OSR exit
compiler's reboxAccordingToFormat() was never updated, so when such an
exit is compiled it falls into RELEASE_ASSERT_NOT_REACHED().
The recovered storage value is the raw butterfly pointer that
operationMaterializeObjectInOSR(PhantomNewArrayWithButterfly) consumes
via std::bit_cast<Butterfly*>, so no boxing is required; treat it the
same as DataFormatJS and pass it through unchanged.
Test:
JSTests/stress/ftl-osr-exit-materialize-phantom-array-with-live-butterfly.js
*
JSTests/stress/ftl-osr-exit-materialize-phantom-array-with-live-butterfly.js:
Added.
(check):
(main.v2):
(main):
* Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp:
(JSC::FTL::reboxAccordingToFormat):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1096@webkitglib/2.52
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
