Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 92b9fe2ead6631aefb500e90a2d352a88affa11f
https://github.com/WebKit/WebKit/commit/92b9fe2ead6631aefb500e90a2d352a88affa11f
Author: Dan Hecht <[email protected]>
Date: 2026-09-08 (Tue, 08 Sep 2026)
Changed paths:
A JSTests/wasm/gc/backwards-graph-multi-backedge-licm.js
M Source/JavaScriptCore/b3/B3Procedure.h
M Source/JavaScriptCore/b3/testb3.h
M Source/JavaScriptCore/b3/testb3_1.cpp
M Source/JavaScriptCore/b3/testb3_7.cpp
M Source/WTF/wtf/BackwardsGraph.h
Log Message:
-----------
Cherry-pick [email protected] (dec21f1baf1f).
https://bugs.webkit.org/show_bug.cgi?id=317603
[JSC] Fix BackwardsGraph for loops with multiple back-edge sources
https://bugs.webkit.org/show_bug.cgi?id=317603
rdar://178735697
Reviewed by Marcus Plutowski.
The addRootSuccessor lambda in WTF::BackwardsGraph used a single
GraphNodeWorklist both to decide synthetic-root membership and to drive
the predecessor-coverage flood. Depending on the order that back-edges
were processed, this would cause some back-edge sources to not be
included as backwards root successors.
B3::BackwardsDominators, built on the resulting incomplete reverse CFG, can
then report that a block post-dominates the loop pre-header even though a
potentially-infinite loop between them means the block may never execute.
B3HoistLoopInvariantValues uses post-dominators to conclude a
control-dependent
value always runs once the loop is entered, and hoists it into the
pre-header,
so the value can execute on paths where it should not.
Decouple the two roles: addRootSuccessor now records every distinct
back-edge
source and terminal in m_rootSuccessorSet unconditionally, and uses the
worklist only to bound the predecessor flood.
Tests: JSTests/wasm/gc/backwards-graph-multi-backedge-licm.js
Source/JavaScriptCore/b3/testb3_1.cpp
Source/JavaScriptCore/b3/testb3_7.cpp
* JSTests/wasm/gc/backwards-graph-multi-backedge-licm.js: Added.
(catch):
* Source/JavaScriptCore/b3/B3Procedure.h:
* Source/JavaScriptCore/b3/testb3.h:
* Source/JavaScriptCore/b3/testb3_1.cpp:
(run):
* Source/JavaScriptCore/b3/testb3_7.cpp:
(testBackwardsDominatorsWithMultipleBackEdges):
* Source/WTF/wtf/BackwardsGraph.h:
(WTF::BackwardsGraph::BackwardsGraph):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.228@webkitglib/2.54
Commit: a0c79c002d3adaa88824db4f34ea31d6e4efe3ff
https://github.com/WebKit/WebKit/commit/a0c79c002d3adaa88824db4f34ea31d6e4efe3ff
Author: Mark Lam <[email protected]>
Date: 2026-09-08 (Tue, 08 Sep 2026)
Changed paths:
A JSTests/stress/unlinked-metadata-table-finalize-overflow.js
M Source/JavaScriptCore/bytecode/UnlinkedCodeBlockGenerator.cpp
M Source/JavaScriptCore/bytecode/UnlinkedCodeBlockGenerator.h
M Source/JavaScriptCore/bytecode/UnlinkedMetadataTable.cpp
M Source/JavaScriptCore/bytecode/UnlinkedMetadataTable.h
M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
Log Message:
-----------
Cherry-pick [email protected] (9343a9521f58).
https://bugs.webkit.org/show_bug.cgi?id=317632
Handle overflows in UnlinkedMetadataTable::finalize().
https://bugs.webkit.org/show_bug.cgi?id=317632
rdar://172794625
Reviewed by Dan Hecht.
If the number of opcodes (with metadata of substantive size) is large, the
32-bit unsigned
computed buffer offsets in UnlinkedMetadataTable::finalize() can overflow.
This patch
applies the use of CheckedArithmetic to detect and handle any potential
overflows. In the
event of a detected overflow, we'll propagate the failure to allocate the
bytecode metadata
up to the BytecodeGenerator, and treat its as an OOM error during parsing.
Test: JSTests/stress/unlinked-metadata-table-finalize-overflow.js
* JSTests/stress/unlinked-metadata-table-finalize-overflow.js: Added.
(try.f):
(catch):
* Source/JavaScriptCore/bytecode/UnlinkedCodeBlockGenerator.cpp:
(JSC::UnlinkedCodeBlockGenerator::finalize):
* Source/JavaScriptCore/bytecode/UnlinkedCodeBlockGenerator.h:
* Source/JavaScriptCore/bytecode/UnlinkedMetadataTable.cpp:
(JSC::UnlinkedMetadataTable::finalize):
* Source/JavaScriptCore/bytecode/UnlinkedMetadataTable.h:
* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::generate):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.229@webkitglib/2.54
Commit: 2b0366caa04401a0bdee31482a168928e1811381
https://github.com/WebKit/WebKit/commit/2b0366caa04401a0bdee31482a168928e1811381
Author: Anand Srinivasan <[email protected]>
Date: 2026-09-08 (Tue, 08 Sep 2026)
Changed paths:
A JSTests/stress/b3-ccmp-chain.js
M Source/JavaScriptCore/b3/B3LowerToAir.cpp
M Source/JavaScriptCore/b3/testb3.h
M Source/JavaScriptCore/b3/testb3_1.cpp
M Source/JavaScriptCore/b3/testb3_8.cpp
Log Message:
-----------
Cherry-pick 320274@main (65ef7f38f8f9).
https://bugs.webkit.org/show_bug.cgi?id=315389
Make B3 ccmp chain matcher use RAII
https://bugs.webkit.org/show_bug.cgi?id=315389
rdar://176792415
Reviewed by Keith Miller.
B3 ccmp chain matcher needs to roll back if a given pattern match fails
part way through. RAII is a more principled and less error prone way to
handle this.
Test: JSTests/stress/b3-ccmp-chain.js
* JSTests/stress/b3-ccmp-chain.js: Added.
(f):
(f_legit_chain):
* Source/JavaScriptCore/b3/B3LowerToAir.cpp:
* Source/JavaScriptCore/b3/testb3.h:
* Source/JavaScriptCore/b3/testb3_1.cpp:
(run):
* Source/JavaScriptCore/b3/testb3_8.cpp:
(testCCmpChainRollback):
Originally-landed-as: [email protected] (7e01f14f8eb7).
rdar://185367009
Canonical link: https://commits.webkit.org/320274@main
Canonical link: https://commits.webkit.org/317695.230@webkitglib/2.54
Compare: https://github.com/WebKit/WebKit/compare/19c5e4df06f4...2b0366caa044
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
