Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 2620d0dbd518fe150e430667996aeb2d94ecd75d
https://github.com/WebKit/WebKit/commit/2620d0dbd518fe150e430667996aeb2d94ecd75d
Author: Shu-yu Guo <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A
JSTests/stress/multi-put-by-offset-reallocating-storage-needs-write-barrier.js
M Source/JavaScriptCore/dfg/DFGStoreBarrierInsertionPhase.cpp
Log Message:
-----------
[JSC] Insert barrier for MultiPutByOffset when it can reallocate storage
https://bugs.webkit.org/show_bug.cgi?id=314747
rdar://176792407
Reviewed by Keith Miller.
The DFG barrier insertion phase works by tracking an "epoch" serial number,
which is bumped every time it encounters a node that can GC. The assumption is
that each DFG node either does a store, which would need to be considered for
barrier insertion, or performs a GC.
MultiPutByOffset is a "fat" node that can GC and perform a store after that GC,
in sequence. The current analysis therefore incorrectly elides the barrier for
it. This PR fixes by special casing.
Test:
JSTests/stress/multi-put-by-offset-reallocating-storage-needs-write-barrier.js
*
JSTests/stress/multi-put-by-offset-reallocating-storage-needs-write-barrier.js:
Added.
(foo):
* Source/JavaScriptCore/dfg/DFGStoreBarrierInsertionPhase.cpp:
Originally-landed-as: 305413.909@safari-7624-branch (2b4933eb1658).
rdar://180427769
Canonical link: https://commits.webkit.org/316139@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
