Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8283d4f1273add66f659b203baaae8e56c4fc3f2
https://github.com/WebKit/WebKit/commit/8283d4f1273add66f659b203baaae8e56c4fc3f2
Author: Yusuke Suzuki <[email protected]>
Date: 2026-08-23 (Sun, 23 Aug 2026)
Changed paths:
A JSTests/stress/uint32-array-result-int32-dfg.js
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
Log Message:
-----------
[JSC] DFG Uint32Array load should consider about Int32 speculation path
https://bugs.webkit.org/show_bug.cgi?id=319112
rdar://176792844
Reviewed by Mark Lam.
DFG Uint32Array GetByVal may have Int32 result with speculation. But the
current code is always using boxed-double for boxed result. We should
use boxed-int32 when this speculation is set. The same thing is already
done in FTL.
Test: JSTests/stress/uint32-array-result-int32-dfg.js
* JSTests/stress/uint32-array-result-int32-dfg.js: Added.
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::setIntTypedArrayLoadResult):
Originally-landed-as: [email protected] (2bc65ac3560e).
rdar://185368553
Canonical link: https://commits.webkit.org/319669@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
