Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 44a6ef81be0355f543f632f3b37a27bc2b16c8bc
https://github.com/WebKit/WebKit/commit/44a6ef81be0355f543f632f3b37a27bc2b16c8bc
Author: Sosuke Suzuki <[email protected]>
Date: 2026-04-12 (Sun, 12 Apr 2026)
Changed paths:
A
JSTests/modules/module-var-resolve-scope-osr-availability-in-async-finally.js
A
JSTests/modules/module-var-resolve-scope-osr-availability-in-async-finally/h.js
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
Log Message:
-----------
[JSC] DFG should keep scope OSR-available for ModuleVar resolve_scope
https://bugs.webkit.org/show_bug.cgi?id=312043
Reviewed by Yusuke Suzuki.
// h.mjs
export const g = 1;
// m.mjs
import { g } from "./h.mjs";
async function f(a) {
try {
if (a) return;
await 1;
} finally { g; }
}
for (let i = 0; i < 1e6; i++) await f(0);
With --validateGraph=1 this hits "Live bytecode local not available".
BytecodeUseDef marks m_scope as a use of op_resolve_scope unconditionally,
but the ModuleVar case in ByteCodeParser was the only resolve type that
skipped Phantom(get(m_scope)). In an async function the scope register has
two reaching defs (initial GetScope and post-resume GetClosureVar), so at a
merge point that only sees a ModuleVar resolve_scope, no Phi is inserted and
the scope becomes unavailable for OSR exit.
Tests:
JSTests/modules/module-var-resolve-scope-osr-availability-in-async-finally.js
JSTests/modules/module-var-resolve-scope-osr-availability-in-async-finally/h.js
*
JSTests/modules/module-var-resolve-scope-osr-availability-in-async-finally.js:
Added.
(async f):
*
JSTests/modules/module-var-resolve-scope-osr-availability-in-async-finally/h.js:
Added.
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
Canonical link: https://commits.webkit.org/311044@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
