Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 7d6c85ebcb93c10e4c31cbdae6bcadbdd11e2158
https://github.com/WebKit/WebKit/commit/7d6c85ebcb93c10e4c31cbdae6bcadbdd11e2158
Author: Yijia Huang <[email protected]>
Date: 2025-03-23 (Sun, 23 Mar 2025)
Changed paths:
A JSTests/stress/array-allocation-sink-upsilon-with-double-value.js
M Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp
Log Message:
-----------
[JSC] ASSERTION FAILED: child(0)->type() == phi->type()
rdar://147364146
https://bugs.webkit.org/show_bug.cgi?id=290009
Reviewed by Yusuke Suzuki.
Array allocation sinking introduced cases where Upsilon edges may come from
nodes
with result types like double or int52, instead of the previously assumed JS
result
type. This breaks assumptions made during Phi construction, which always
expected
NodeResultJS.
This patch adds `fixUpsilonEdge()`, a pass that ensures Upsilon inputs match the
expected Phi result type by inserting appropriate ValueRep nodes when needed.
* JSTests/stress/array-allocation-sink-upsilon-with-double-value.js: Added.
(test):
* Source/JavaScriptCore/dfg/DFGFlushFormat.h:
Canonical link: https://commits.webkit.org/292572@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
