Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 1b8a020d3b8254330b13403456a220e4560a828f
https://github.com/WebKit/WebKit/commit/1b8a020d3b8254330b13403456a220e4560a828f
Author: Yusuke Suzuki <[email protected]>
Date: 2025-10-11 (Sat, 11 Oct 2025)
Changed paths:
A JSTests/stress/dfg-new-regexp-untyped-should-say-spec-object.js
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
Log Message:
-----------
JIT Optimization bug: DFG ASSERTION FAILED: Bad data format
https://bugs.webkit.org/show_bug.cgi?id=299846
rdar://161617852
Reviewed by Sosuke Suzuki.
When using cellResult in DFG, we should say SpecCell or narrower types
in DFG AI. Otherwise, DataFormat becomes incompatible, and causing
release assert. We were too conservative about the return type in AI
before.
Test: JSTests/stress/dfg-new-regexp-untyped-should-say-spec-object.js
* JSTests/stress/dfg-new-regexp-untyped-should-say-spec-object.js: Added.
(foo):
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
Canonical link: https://commits.webkit.org/301359@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
