Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 72ea806faa2186f39c48899724ad6c2f336270ac
https://github.com/WebKit/WebKit/commit/72ea806faa2186f39c48899724ad6c2f336270ac
Author: Sergey Rubanov <[email protected]>
Date: 2026-07-29 (Wed, 29 Jul 2026)
Changed paths:
M Source/JavaScriptCore/b3/B3LowerMacros.cpp
M Source/JavaScriptCore/b3/testb3.h
M Source/JavaScriptCore/b3/testb3_1.cpp
M Source/JavaScriptCore/b3/testb3_5.cpp
Log Message:
-----------
[JSC] Use overflow-safe range when choosing a switch jump table
https://bugs.webkit.org/show_bug.cgi?id=317022
Reviewed by Keith Miller.
recursivelyBuildSwitch picks a jump table when (last - first + 1) / n is
below a density limit. When case values span more than 2^63, that
subtraction overflows signed int64; the wrapped result can look dense and
tableSize becomes enormous, OOMing in BitVector / data-section allocation.
Compute the span with CheckedInt64 and skip the table path on overflow.
Add a testb3 case with the sparse i64 values from the bug report.
* Source/JavaScriptCore/b3/B3LowerMacros.cpp:
(JSC::B3::LowerMacros::recursivelyBuildSwitch): Checked span for density.
* Source/JavaScriptCore/b3/testb3.h:
* Source/JavaScriptCore/b3/testb3_1.cpp:
* Source/JavaScriptCore/b3/testb3_5.cpp:
(testSwitchSparseI64RangeOverflow): Added.
Canonical link: https://commits.webkit.org/318166@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
