Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 7d867192b7ab40a0c797e68d86a5842884729bea
https://github.com/WebKit/WebKit/commit/7d867192b7ab40a0c797e68d86a5842884729bea
Author: Dan Hecht <[email protected]>
Date: 2026-08-24 (Mon, 24 Aug 2026)
Changed paths:
A JSTests/wasm/gc/backwards-graph-multi-backedge-licm.js
M Source/JavaScriptCore/b3/B3Procedure.h
M Source/JavaScriptCore/b3/testb3.h
M Source/JavaScriptCore/b3/testb3_1.cpp
M Source/JavaScriptCore/b3/testb3_7.cpp
M Source/WTF/wtf/BackwardsGraph.h
Log Message:
-----------
[JSC] Fix BackwardsGraph for loops with multiple back-edge sources
https://bugs.webkit.org/show_bug.cgi?id=317603
rdar://178735697
Reviewed by Marcus Plutowski.
The addRootSuccessor lambda in WTF::BackwardsGraph used a single
GraphNodeWorklist both to decide synthetic-root membership and to drive
the predecessor-coverage flood. Depending on the order that back-edges
were processed, this would cause some back-edge sources to not be
included as backwards root successors.
B3::BackwardsDominators, built on the resulting incomplete reverse CFG, can
then report that a block post-dominates the loop pre-header even though a
potentially-infinite loop between them means the block may never execute.
B3HoistLoopInvariantValues uses post-dominators to conclude a control-dependent
value always runs once the loop is entered, and hoists it into the pre-header,
so the value can execute on paths where it should not.
Decouple the two roles: addRootSuccessor now records every distinct back-edge
source and terminal in m_rootSuccessorSet unconditionally, and uses the
worklist only to bound the predecessor flood.
Tests: JSTests/wasm/gc/backwards-graph-multi-backedge-licm.js
Source/JavaScriptCore/b3/testb3_1.cpp
Source/JavaScriptCore/b3/testb3_7.cpp
* JSTests/wasm/gc/backwards-graph-multi-backedge-licm.js: Added.
(catch):
* Source/JavaScriptCore/b3/B3Procedure.h:
* Source/JavaScriptCore/b3/testb3.h:
* Source/JavaScriptCore/b3/testb3_1.cpp:
(run):
* Source/JavaScriptCore/b3/testb3_7.cpp:
(testBackwardsDominatorsWithMultipleBackEdges):
* Source/WTF/wtf/BackwardsGraph.h:
(WTF::BackwardsGraph::BackwardsGraph):
Originally-landed-as: [email protected] (dec21f1baf1f).
rdar://185366847
Canonical link: https://commits.webkit.org/319700@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
