Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: ab5dbb2f726501ae06b20355ac64dfa9daa10b80
https://github.com/WebKit/WebKit/commit/ab5dbb2f726501ae06b20355ac64dfa9daa10b80
Author: Kai Tamkun <[email protected]>
Date: 2026-09-04 (Fri, 04 Sep 2026)
Changed paths:
A JSTests/wasm/regress/try-catch-result-type.js
M Source/JavaScriptCore/wasm/WasmFunctionParser.h
Log Message:
-----------
Cherry-pick [email protected] (39a1fcf84d47).
https://bugs.webkit.org/show_bug.cgi?id=317450
[JSC] WebAssembly try/catch result-type confusion omits optimized reference
checks
https://bugs.webkit.org/show_bug.cgi?id=317450
rdar://179017779
Reviewed by Yusuke Suzuki.
This patch expands an expression stack check to force the signature
in all cases, not just for if/else.
Test: JSTests/wasm/regress/try-catch-result-type.js
* JSTests/wasm/regress/try-catch-result-type.js: Added.
* Source/JavaScriptCore/wasm/WasmFunctionParser.h:
(JSC::Wasm::FunctionParser<Context>::parseExpression):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1142@webkitglib/2.52
Commit: 1eb17e8b45fddb0afce599820e3e0f36d91edb29
https://github.com/WebKit/WebKit/commit/1eb17e8b45fddb0afce599820e3e0f36d91edb29
Author: Kai Tamkun <[email protected]>
Date: 2026-09-04 (Fri, 04 Sep 2026)
Changed paths:
A
JSTests/stress/absence-propertycondition-and-non-reified-static-property-tables.js
M Source/JavaScriptCore/bytecode/PropertyCondition.cpp
Log Message:
-----------
Cherry-pick [email protected] (d0cd53048a11).
https://bugs.webkit.org/show_bug.cgi?id=314836
[JavaScriptCore] Absence PropertyCondition does not consult non-reified
static property tables
https://bugs.webkit.org/show_bug.cgi?id=314836
rdar://176792596
Reviewed by Yusuke Suzuki.
This patch modifies the Absence case for
PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint
to consult the non-reified static property table if the property isn't
present in the property table.
This prevents the Abstract Interpreter from misfolding GetById.
Test:
JSTests/stress/absence-propertycondition-and-non-reified-static-property-tables.js
*
JSTests/stress/absence-propertycondition-and-non-reified-static-property-tables.js:
Added.
(assert):
(assertThrows):
(setup):
(f):
* Source/JavaScriptCore/bytecode/PropertyCondition.cpp:
(JSC::PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint
const):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1143@webkitglib/2.52
Commit: 99f7cbec1ad46d9eb486fe7097bd2fef5c90ff44
https://github.com/WebKit/WebKit/commit/99f7cbec1ad46d9eb486fe7097bd2fef5c90ff44
Author: Kai Tamkun <[email protected]>
Date: 2026-09-04 (Fri, 04 Sep 2026)
Changed paths:
A JSTests/stress/inc-dec-int32-overflow-dce.js
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
Log Message:
-----------
Cherry-pick [email protected] (7951c397a1ba).
https://bugs.webkit.org/show_bug.cgi?id=315213
[JSC] NodeMustGenerate incorrectly cleared on CheckOverflow
ArithAdd/ArithSub in DFGFixupPhase Inc/Dec handler
https://bugs.webkit.org/show_bug.cgi?id=315213
rdar://176984293
Reviewed by Yijia Huang.
This patch prevents overflow checks for increment/decrement in DFG from
being mistakenly DCE'd.
Test: JSTests/stress/inc-dec-int32-overflow-dce.js
* JSTests/stress/inc-dec-int32-overflow-dce.js: Added.
(shouldBe):
(inc):
(dec):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1144@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/a8ae94eba311...99f7cbec1ad4
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
