Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 48a4516616c36fdebf59645f93c14b0a3f9d0914
https://github.com/WebKit/WebKit/commit/48a4516616c36fdebf59645f93c14b0a3f9d0914
Author: Anand Srinivasan <[email protected]>
Date: 2026-09-08 (Tue, 08 Sep 2026)
Changed paths:
A JSTests/stress/b3-ccmp-chain.js
M Source/JavaScriptCore/b3/B3LowerToAir.cpp
M Source/JavaScriptCore/b3/testb3.h
M Source/JavaScriptCore/b3/testb3_1.cpp
M Source/JavaScriptCore/b3/testb3_8.cpp
Log Message:
-----------
Cherry-pick [email protected] (7e01f14f8eb7).
https://bugs.webkit.org/show_bug.cgi?id=315389
Make B3 ccmp chain matcher use RAII
https://bugs.webkit.org/show_bug.cgi?id=315389
rdar://176792415
Reviewed by Keith Miller.
B3 ccmp chain matcher needs to roll back if a given pattern match fails
part way through. RAII is a more principled and less error prone way to
handle this.
Test: JSTests/stress/b3-ccmp-chain.js
* JSTests/stress/b3-ccmp-chain.js: Added.
(f):
(f_legit_chain):
* Source/JavaScriptCore/b3/B3LowerToAir.cpp:
* Source/JavaScriptCore/b3/testb3.h:
* Source/JavaScriptCore/b3/testb3_1.cpp:
(run):
* Source/JavaScriptCore/b3/testb3_8.cpp:
(testCCmpChainRollback):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1159@webkitglib/2.52
Commit: 4185bc0d49f8bd79d0c2eebeed87a5ece28ca05d
https://github.com/WebKit/WebKit/commit/4185bc0d49f8bd79d0c2eebeed87a5ece28ca05d
Author: Anand Srinivasan <[email protected]>
Date: 2026-09-08 (Tue, 08 Sep 2026)
Changed paths:
A JSTests/wasm/stress/br-on-cast-fail-overlong-leb128.js
A JSTests/wasm/stress/br-on-cast-overlong-leb128.js
M Source/JavaScriptCore/llint/InPlaceInterpreter64.asm
M Source/JavaScriptCore/wasm/WasmIPIntGenerator.cpp
M Source/JavaScriptCore/wasm/WasmIPIntGenerator.h
Log Message:
-----------
Cherry-pick [email protected] (5b76326e8fc9).
https://bugs.webkit.org/show_bug.cgi?id=317349
IPInt br_on_cast/br_on_cast_fail must handle overlong LEB128 opcode
https://bugs.webkit.org/show_bug.cgi?id=317349
rdar://178289134
Reviewed by Yusuke Suzuki.
Currently IPInt implementations of br_on_cast/br_on_cast_fail assume
flags are at a fixed offset in the instruction but overlong opcodes
are legal and IPInt may use the wrong byte to load flags. This patch
makes the validator cache allowNull in metadata so IPInt no longer
loads from the instruction stream at all.
Tests: JSTests/wasm/stress/br-on-cast-fail-overlong-leb128.js
JSTests/wasm/stress/br-on-cast-overlong-leb128.js
* JSTests/wasm/stress/br-on-cast-fail-overlong-leb128.js: Added.
(uleb):
(section):
(str):
* JSTests/wasm/stress/br-on-cast-overlong-leb128.js: Added.
(uleb):
(section):
(str):
* Source/JavaScriptCore/llint/InPlaceInterpreter64.asm:
* Source/JavaScriptCore/wasm/WasmIPIntGenerator.cpp:
(JSC::Wasm::IPIntGenerator::addRefTest):
(JSC::Wasm::IPIntGenerator::addRefCast):
(JSC::Wasm::IPIntGenerator::addBranchCast):
* Source/JavaScriptCore/wasm/WasmIPIntGenerator.h:
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1160@webkitglib/2.52
Commit: 71731a79be7f75a85ab7f76e2e5b79bccbbaa6a4
https://github.com/WebKit/WebKit/commit/71731a79be7f75a85ab7f76e2e5b79bccbbaa6a4
Author: Anand Srinivasan <[email protected]>
Date: 2026-09-08 (Tue, 08 Sep 2026)
Changed paths:
A JSTests/stress/watchpoint-async-generator-code-deletion.js
A JSTests/stress/watchpoint-closure-not-affected.js
M Source/JavaScriptCore/bytecode/CodeBlock.cpp
Log Message:
-----------
Cherry-pick [email protected] (1af72a6f5454).
https://bugs.webkit.org/show_bug.cgi?id=313499
Pre-invalidate captured-variable WatchpointSets in generator and async
function bodies
https://bugs.webkit.org/show_bug.cgi?id=313499
rdar://173777534
Reviewed by Yusuke Suzuki.
When deleteAllCode runs while an async generator is suspended, the generator
body's CodeBlock is cleared and later re-created from re-parsed source. The
new CodeBlock's constant pool gets a fresh SymbolTable clone with fresh
WatchpointSets, but the suspended activation still references the original.
A subsequent ResolvedClosureVar put_to_scope on the new CodeBlock fires
touch() against the fresh clone's WatchpointSet, which the DFG is not
watching, so DFG code that constant-folded the captured variable never
deoptimizes and returns stale values.
Treat ResolvedClosureVar writes inside suspendable bodies the same way
ClosureVar writes are already treated: invalidate the WatchpointSet at
link time. Sibling closures using ClosureVar already pay this cost;
extending it to the declaring function eliminates the only remaining
runtime path that relies on SymbolTable identity across re-link.
Tests: JSTests/stress/watchpoint-async-generator-code-deletion.js
JSTests/stress/watchpoint-closure-not-affected.js
* JSTests/stress/watchpoint-async-generator-code-deletion.js: Added.
(async sleepAsync):
(async main.opt):
(async main):
* JSTests/stress/watchpoint-closure-not-affected.js: Added.
(async sleepAsync):
(async test.):
(async test.obj):
* Source/JavaScriptCore/bytecode/CodeBlock.cpp:
(JSC::CodeBlock::finishCreation):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1161@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/2518b601960e...71731a79be7f
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
