Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: eb79fa320bba34f92a80e8be53d2e3c12c58dcb8
https://github.com/WebKit/WebKit/commit/eb79fa320bba34f92a80e8be53d2e3c12c58dcb8
Author: Shu-yu Guo <[email protected]>
Date: 2026-10-08 (Thu, 08 Oct 2026)
Changed paths:
A JSTests/stress/dfg-cross-realm-builtin-closure-call-realm-check.js
A JSTests/stress/dfg-cross-realm-builtin-error-realm.js
A JSTests/stress/dfg-cross-realm-builtin-result-realm.js
M Source/JavaScriptCore/bytecode/ExitKind.h
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/dfg/DFGNode.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Log Message:
-----------
[JSC] Centralize cross-realm check when inlining intrinsics in DFG
https://bugs.webkit.org/show_bug.cgi?id=326410
rdar://189057417
Reviewed by Keith Miller and Yusuke Suzuki.
JS built-ins run in the realm in which they were created and not its
caller's. This is observable via object allocation, including of Error
objects when throwing. Currently DFG doesn't inline cross-realm calls to
intrinsics using an ad-hoc check, making it easy to miss cases and introduce
non-compliance.
This PR centralizes the cross-realm intrinsic check inside
handleIntrinsicCall and allows speculatively inlining possibly same-realm
calls:
- A few intrinsics have no realm-dependent behavior. There is an opt-in
allowlist for intrinsics that are safe to inline cross-realm. The default is
no cross-realm inlining.
- When only the callee's executable is known, speculate that the call is
same-realm with a runtime check against the realm, with a new BadRealm exit
kind. Stop speculating same-realm at this site if in the future if it ever
exits. A new exit kind is needed to distinguish from a failed callee check.
This PR also changes handleConstantFunction to lower cross-realm calls only for
constructors get their realm from their function objects.
Tests: JSTests/stress/dfg-cross-realm-builtin-closure-call-realm-check.js
JSTests/stress/dfg-cross-realm-builtin-error-realm.js
JSTests/stress/dfg-cross-realm-builtin-result-realm.js
* Source/JavaScriptCore/bytecode/ExitKind.h:
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::intrinsicSupportsCalleeFromAnyRealm):
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
(JSC::DFG::constantFunctionSupportsCalleeFromAnyRealm):
(JSC::DFG::ByteCodeParser::handleTypedArrayConstructor):
(JSC::DFG::ByteCodeParser::handleConstantFunction):
(JSC::DFG::calleeMayBeCrossRealm): Deleted.
* Source/JavaScriptCore/dfg/DFGNode.h:
(JSC::DFG::Node::checkIsConstantExitKind):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileCheckIsConstant):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCheckIsConstant):
* JSTests/stress/dfg-cross-realm-builtin-closure-call-realm-check.js: Added.
(const.object.valueOf):
(apply):
(i.catch):
* JSTests/stress/dfg-cross-realm-builtin-error-realm.js: Added.
(const.object.valueOf):
(const.object.toString):
(const.noPrimitive.valueOf):
(const.noPrimitive.toString):
(numberCall):
(stringCall):
(stringConstruct):
(arrayConstruct):
(int8ArrayConstruct):
(arrayBufferConstruct):
(regExpConstruct):
(symbolCall):
(numberClosureCall):
(stringClosureCall):
(mathAbs):
(mathSqrt):
(mathFloor):
(mathCeil):
(mathRound):
(mathTrunc):
(mathClz32):
(mathFround):
(mathSin):
(parseIntCall):
(isNaNCall):
(isFiniteCall):
(fromCharCode):
(fromCodePoint):
(fromCodePointInt32):
(isArrayCall):
(revokedProxy):
(numberToStringRadix):
(stringValueOf):
(regExpExec):
(i.ErrorConstructor.of.tests.catch):
* JSTests/stress/dfg-cross-realm-builtin-result-realm.js: Added.
(booleanCall):
(booleanClosureCall):
(objectCall):
(objectConstruct):
(mapConstruct):
(setConstruct):
(weakMapConstruct):
(weakSetConstruct):
(regExpExec):
Canonical link: https://commits.webkit.org/323152@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
