Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 045fd8ec92379f84a295cee0cdb6477896b05d26
https://github.com/WebKit/WebKit/commit/045fd8ec92379f84a295cee0cdb6477896b05d26
Author: Yusuke Suzuki <[email protected]>
Date: 2025-11-12 (Wed, 12 Nov 2025)
Changed paths:
A JSTests/stress/map-set-iterator-speculated-types.js
M Source/JavaScriptCore/bytecode/SpeculatedType.cpp
M Source/JavaScriptCore/bytecode/SpeculatedType.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/dfg/DFGUseKind.h
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/runtime/JSType.h
Log Message:
-----------
[JSC] JSMapIterator and JSSetIterator need to have distinct SpeculatedTypes
for Use edge filtering
https://bugs.webkit.org/show_bug.cgi?id=297662
rdar://158692260
Reviewed by Yijia Huang.
Each Use edge filtering needs distinct SpeculatedTypes. However
JSMapIterator and JSSetIterator were using SpecObjectOther bucket, which
can be used for different types. This fails to ensure that edge
filtering's type guarantee. This patch adds SpecMapIteratorObject and
SpecSetIteratorObject and uses them instead.
* JSTests/stress/map-set-iterator-speculated-types.js: Added.
(test):
* Source/JavaScriptCore/bytecode/SpeculatedType.cpp:
(JSC::speculationFromJSType):
* Source/JavaScriptCore/bytecode/SpeculatedType.h:
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
* Source/JavaScriptCore/dfg/DFGUseKind.h:
(JSC::DFG::typeFilterFor):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* Source/JavaScriptCore/runtime/JSType.h:
Originally-landed-as: 297297.289@safari-7622-branch (528c899d1d87).
rdar://164280584
Canonical link: https://commits.webkit.org/302965@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
