Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: f9dcd0ee93e44247a8ff0fe63029c35dcc9a259a
https://github.com/WebKit/WebKit/commit/f9dcd0ee93e44247a8ff0fe63029c35dcc9a259a
Author: Yusuke Suzuki <[email protected]>
Date: 2026-10-08 (Thu, 08 Oct 2026)
Changed paths:
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Log Message:
-----------
[JSC] FTL CheckJSCast always OSR exits for classes with a JSType range
https://bugs.webkit.org/show_bug.cgi?id=326765
rdar://189477440
Reviewed by Keith Miller.
compileCheckJSCast negated the type check result with Output::bitNot, which is
BitXor with -1. Applied to a 0/1 comparison result it yields -1 or -2, both
non-zero, so the Check fired whether or not the cell had the right type. Every
CheckJSCast on a class with inheritsJSTypeRange that survived to FTL therefore
took a BadType OSR exit each time it ran, for example the one emitted for
for-await over async generators. Use logicalNot instead.
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
Canonical link: https://commits.webkit.org/323102@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
