Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 3f4f81750dc5d4ec8208c35be8a094ac2dbf8bdc
https://github.com/WebKit/WebKit/commit/3f4f81750dc5d4ec8208c35be8a094ac2dbf8bdc
Author: Sosuke Suzuki <[email protected]>
Date: 2026-04-29 (Wed, 29 Apr 2026)
Changed paths:
A JSTests/stress/iterator-dfg-fast-path-watchpoint-invalidated-array.js
A JSTests/stress/iterator-dfg-fast-path-watchpoint-invalidated-map.js
A JSTests/stress/iterator-dfg-fast-path-watchpoint-invalidated-set.js
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
Log Message:
-----------
[JSC] DFG `iterator_open` / `iterator_next` leave dangling failedBlock when a
fast-mode watchpoint is invalidated
https://bugs.webkit.org/show_bug.cgi?id=313570
Reviewed by Yusuke Suzuki.
After 312127@main, seenModes can contain multiple fast modes. When one of
their iterator-protocol watchpoints has already fired, that case was skipped
without decrementing numberOfRemainingModes. The remaining fast mode then
allocated a failedBlock that was never connected, leaving a BasicBlock with
no terminal and crashing in Graph::determineReachability().
Mask out invalidated fast modes from seenModes up front, and drop the
redundant isStillValid() check from each case (addLazily() handles
concurrent invalidation at finalize time).
Test: JSTests/stress/iterator-dfg-fast-path-watchpoint-invalidated.js
* JSTests/stress/iterator-dfg-fast-path-watchpoint-invalidated.js: Added.
(shouldBe):
(sumArrayOrMap):
(noInline.Array.prototype.Symbol.iterator):
(noInline):
(sumMapOrSet):
(noInline.let.set new):
(noInline.Set.prototype.Symbol.iterator):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIteratorOpen):
(JSC::DFG::ByteCodeParser::handleIteratorNext):
Canonical link: https://commits.webkit.org/312290@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
