305721 2026-01-18 04:47:13 -0800 Crashing in thought-to-be-unreachable FTL-generated code 2026-01-22 21:53:48 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 katoshi1337 ysuzuki bfulgham webkit-bug-importer ysuzuki oldest_to_newest 2172820 0 katoshi1337 2026-01-18 04:47:13 -0800 Poc.js: let v1 = 2.0; for (let v2 = 0; v2 < 100; v2++) { let v3 = -1061384422; function f4(a5, a6, a7) { if (!(a5 == -4294967297)) { } a5 * a6; Math.abs(Math); v3++; return v1; } for (let v13 = 0; v13 < 100; v13++) { f4(v13, v1); } } v1++; gc(); ./jsc --thresholdForJITSoon=10 --thresholdForJITAfterWarmUp=10 --thresholdForOptimizeAft erWarmUp=100 --thresholdForOptimizeAfterLongWarmUp=100 --thresholdForFTLOptimizeAfterWarmUp=1000 --thresholdForFTLOptimizeSoon=1000 ./poc.js Crashing in thought-to-be-unreachable FTL-generated code for <global>#BI1NYd:[0x7fffe94a07b0->0x7fffe94a0150->0x7fffeb02d988, FTLGlobal, 195 (DidTryToEnterInLoop)] at basic block #5, node @0. 2172821 1 webkit-bug-importer 2026-01-18 04:47:19 -0800 <rdar://problem/168397840> 2174200 2 ysuzuki 2026-01-22 12:44:34 -0800 This is a deterministic crash via FTL unreachable. So not security issue. 2174205 3 ysuzuki 2026-01-22 12:56:29 -0800 Pull request: https://github.com/WebKit/WebKit/pull/57066 2174367 4 ews-feeder 2026-01-22 21:53:46 -0800 Committed 306060@main (dc60e5a7e380): <https://commits.webkit.org/306060@main> Reviewed commits have been landed. Closing PR #57066 and removing active labels.