Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d9cbe05de1dc7c1e4759b994d669f025cdcc4606
https://github.com/WebKit/WebKit/commit/d9cbe05de1dc7c1e4759b994d669f025cdcc4606
Author: Shu-yu Guo <[email protected]>
Date: 2026-05-11 (Mon, 11 May 2026)
Changed paths:
A JSTests/stress/array-allocation-sink-contiguous-hole-osr-exit.js
M Source/JavaScriptCore/ftl/FTLOperations.cpp
Log Message:
-----------
[JSC] Fix hole-handling when rematerializing sunk int32 arrays
https://bugs.webkit.org/show_bug.cgi?id=313268
rdar://176051382
Reviewed by Yusuke Suzuki.
This PR is a followup to the incomplete fix in 311962@main. The hole value for
int32 arrays, the empty JSValue, also triggers spurious conversion to
contiguous storage and needs to be handle specially.
Test: JSTests/stress/array-allocation-sink-contiguous-hole-osr-exit.js
* JSTests/stress/array-allocation-sink-contiguous-hole-osr-exit.js: Added.
* Source/JavaScriptCore/ftl/FTLOperations.cpp:
(JSC::FTL::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):
Canonical link: https://commits.webkit.org/313041@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
