Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6d14496d48016e24a4ad73bbb2f578e01fd8c39a
https://github.com/WebKit/WebKit/commit/6d14496d48016e24a4ad73bbb2f578e01fd8c39a
Author: Keith Miller <[email protected]>
Date: 2025-11-11 (Tue, 11 Nov 2025)
Changed paths:
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Log Message:
-----------
Validate proven values for MaterializeNewArrayWithButterfly at FTL lowering
time
https://bugs.webkit.org/show_bug.cgi?id=302338
rdar://164352313
Reviewed by Yijia Huang.
We're seeing crashes in that ASSERT in the AbstractInterpreter. Let's try
moving the validation to where it's actually important that it's true,
which is at lowering.
No new tests, speculative fix.
Canonical link: https://commits.webkit.org/302860@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
