Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 7dd70bdbdf3c9da3c6a7f56338f2722bde08ea18
https://github.com/WebKit/WebKit/commit/7dd70bdbdf3c9da3c6a7f56338f2722bde08ea18
Author: Dan Hecht <[email protected]>
Date: 2026-09-03 (Thu, 03 Sep 2026)
Changed paths:
M Source/JavaScriptCore/b3/B3PureCSE.cpp
M Source/JavaScriptCore/b3/B3PureCSE.h
M Source/JavaScriptCore/b3/B3ReduceStrength.cpp
M Source/JavaScriptCore/b3/testb3.h
M Source/JavaScriptCore/b3/testb3_1.cpp
M Source/JavaScriptCore/b3/testb3_6.cpp
Log Message:
-----------
Cherry-pick [email protected] (353f0e1145bf).
https://bugs.webkit.org/show_bug.cgi?id=316347
[JSC] Fix B3 ReduceStrength Select specialization when a Check appears
between the Select and triggering Check
https://bugs.webkit.org/show_bug.cgi?id=316347
rdar://177687354
Reviewed by Marcus Plutowski.
In B3ReduceStrength, specializeSelect() specializes a Select that has a
constant
arm and is reached, within selectSpecializationBound, from a Check: it
splits the
block at the Check, clones the values between the Select and the Check into
the
then/else arms, and deleteValue()s the Void ones in that range.
PureCSE records pure Values in a per-iteration map (m_pureCSE) and assumes
they
stay present. Checks, though Void, are also recorded (to enable removing
redundant
Branches), so an intermediate Check in that range is recorded too;
specializeSelect
then deleteValue()s it without updating the map.
Keep the map consistent: remove the value from m_pureCSE before
specializeSelect
deletes it.
Tests: Source/JavaScriptCore/b3/testb3_1.cpp
Source/JavaScriptCore/b3/testb3_6.cpp
* Source/JavaScriptCore/b3/B3PureCSE.cpp:
(JSC::B3::PureCSE::clear):
(JSC::B3::PureCSE::remove):
* Source/JavaScriptCore/b3/B3PureCSE.h:
* Source/JavaScriptCore/b3/B3ReduceStrength.cpp:
* Source/JavaScriptCore/b3/testb3.h:
* Source/JavaScriptCore/b3/testb3_1.cpp:
(run):
* Source/JavaScriptCore/b3/testb3_6.cpp:
(testCheckSelectAndDeadCheckCSE):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.188@webkitglib/2.54
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
