Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 028f6ba94be5bce02b1b903131ba5478165f0ae5
https://github.com/WebKit/WebKit/commit/028f6ba94be5bce02b1b903131ba5478165f0ae5
Author: Keith Miller <[email protected]>
Date: 2026-09-14 (Mon, 14 Sep 2026)
Changed paths:
M Source/JavaScriptCore/API/JSClassRef.cpp
M Source/JavaScriptCore/API/tests/testapi.cpp
Log Message:
-----------
Cherry-pick 316606.72@safari-7625-branch (246fe5217811).
https://bugs.webkit.org/show_bug.cgi?id=319684
OpaqueJSClass should retain/release the parent JSClassRef when provided
https://bugs.webkit.org/show_bug.cgi?id=319684
rdar://182366602
Reviewed by Mark Lam.
We are retain/release-ing the prototype's JSClassRef but not the parent's
class. We should do so otherwise we could UAF the parent class for some
API users.
Test: Source/JavaScriptCore/API/tests/testapi.cpp
Identifier:
316606.72@safari-7625-branch
Canonical link:
https://flagged.apple.com:443/proxy?t2=DH4S5I1Rg7&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjMwN0B3ZWJraXRnbGliLzIuNTQ=&emid=07c2a714-4a97-4abc-ad3a-ed0b27dce315&c=11
Commit: 35c413d575a6378682be21be11f2fc1bd3c2e91c
https://github.com/WebKit/WebKit/commit/35c413d575a6378682be21be11f2fc1bd3c2e91c
Author: Shu-yu Guo <[email protected]>
Date: 2026-09-14 (Mon, 14 Sep 2026)
Changed paths:
A JSTests/wasm/stress/atomic-cmpxchg-motion-interference.js
M Source/JavaScriptCore/b3/B3LowerToAir.cpp
Log Message:
-----------
Cherry-pick 316606.100@safari-7625-branch (1217ca887d85).
https://bugs.webkit.org/show_bug.cgi?id=319842
[JSC] Check for interference when moving CAS to Branch in Air
https://bugs.webkit.org/show_bug.cgi?id=319842
rdar://182130524
Reviewed by Marcus Plutowski.
When lowering B3 to Air, CAS operations with a single Branch consumer can be
fused into the Branch or be moved to the Branch site. This motion needs to
check for interference. Consider the following wasm
snippet:
L1: i32.atomic.rmw.cmpxchg
L2: memory.grow
<some stuff>
L3: if
The cmpxchg in L1 can be moved past the memory.grow in L2 into L3, which is
incorrect as the Air CAS opcode for L1 may have a stale memory input that
interferes with the grow in L2.
This PR adds interference checks for all CAS motions in B3 to Air lowering.
Test: JSTests/wasm/stress/atomic-cmpxchg-motion-interference.js
Identifier: 316606.100@safari-7625-branch
Canonical link:
https://flagged.apple.com:443/proxy?t2=DI3m0c3Mt9&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjMwOEB3ZWJraXRnbGliLzIuNTQ=&emid=07c2a714-4a97-4abc-ad3a-ed0b27dce315&c=11
Commit: 13c5c0326a6838d968e80d039ba0e3b6b24754ff
https://github.com/WebKit/WebKit/commit/13c5c0326a6838d968e80d039ba0e3b6b24754ff
Author: Shu-yu
Guo
<[email protected]>
Date: 2026-09-14 (Mon, 14 Sep 2026)
Changed paths:
A
JSTests/stress/spread-set-cross-realm-symbol-iterator-side-effects.js
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M
Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Log Message:
-----------
Cherry-pick 62860f03b72a. https://bugs.webkit.org/show_bug.cgi?id=321705
[JSC] Fix cross-realm DFG Set spread optimization
https://bugs.webkit.org/show_bug.cgi?id=321705
rdar://184821678
Reviewed by Keith Miller and Mark Lam.
The DFG optimization for spreading a Set depends on the Set iterator
protocol
being intact. This is guarded by a watchpoint. This watchpoint is armed on
the
global of the set itself, which is node->child1(). Subsequent optimization
passes incorrectly depends on the Set structure of node, which corresponds
to
the spread operation itself and may be in
a
different realm than the set.
This PR fixes this by using child1() everywhere to
determine the global.
Test: JSTests/stress/spread-set-cross-realm-symbol-iterator-side-effects.js
* JSTests/stress/spread-set-cross-realm-symbol-iterator-side-effects.js:
Added.
(shouldBe):
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileSpread):
Identifier: 316606.361@safari-7625-branch
Canonical link:
https://flagged.apple.com:443/proxy?t2=Dv5N6K7zo3&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE2NjA2LjMxMUBzYWZhcmktNzYyNS4xLjI5LjEwLWJyYW5jaA==&emid=07c2a714-4a97-4abc-ad3a-ed0b27dce315&c=11
Canonical link:
https://flagged.apple.com:443/proxy?t2=DU0n1b2uF1&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE3Njk1LjMwOUB3ZWJraXRnbGliLzIuNTQ=&emid=07c2a714-4a97-4abc-ad3a-ed0b27dce315&c=11
Compare: https://github.com/WebKit/WebKit/compare/8f2745d6d7b8...13c5c0326a68
To unsubscribe
from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
