Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 77c9af245a2e56ed14008bc4b4d2bee7ddbb4e8c
https://github.com/WebKit/WebKit/commit/77c9af245a2e56ed14008bc4b4d2bee7ddbb4e8c
Author: Keith Miller <[email protected]>
Date: 2026-01-22 (Thu, 22 Jan 2026)
Changed paths:
A JSTests/stress/subclass-forward-varargs-rest-variadic-param-count.js
A JSTests/stress/subclass-forward-varargs-rest.js
M Source/JavaScriptCore/dfg/DFGAvailabilityMap.cpp
M Source/JavaScriptCore/dfg/DFGCommon.h
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGNode.h
M Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp
M Source/JavaScriptCore/dfg/DFGStackLayoutPhase.cpp
Log Message:
-----------
Relax OSRAvailability validation around phantom arguments-like objects
https://bugs.webkit.org/show_bug.cgi?id=304696
rdar://167179244
Reviewed by Yusuke Suzuki.
When we added OSRAvailability validation, it was assumed that every node
would have a SSA know that it could get the recovery from. This is not
true for varargs arguments because we don't always know how many there
will be so we pass them on the stack. This change relaxes the validation
so that we can check for SSA availability for non-arguments while still
being correct for phantom arguments. To make the validation stronger,
the DFG graph now tracks whether it's done stack layout yet. After
stack layout, we validate that the stack recovery is available.
Tests: JSTests/stress/subclass-forward-varargs-rest-variadic-param-count.js
JSTests/stress/subclass-forward-varargs-rest.js
Canonical link: https://commits.webkit.org/306033@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
