Bug 315143

Summary:	DFG abstract interpreter misclassifies ArraySortCompact result as SpecObjectOther instead of SpecCellOther
Product:	WebKit	Reporter:	anand_srinivasan
Component:	JavaScriptCore	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	webkit-bug-importer
Priority:	P1	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	All
OS:	All

anand_srinivasan

Reported 2026-05-19 16:57:28 PDT

rdar://177361524 ArraySortCompact returns a JSCellButterfly but DFG abstract interpreter marks the node as SpecObjectOther instead of SpecCellOther even though a JSCell is not necessarily a JSObject.

Attachments
Add attachment proposed patch, testcase, etc.

anand_srinivasan

Comment 1 2026-05-19 17:17:14 PDT

Pull request: https://github.com/WebKit/WebKit/pull/65242

EWS

Comment 2 2026-05-20 11:16:42 PDT

Committed 313587@main (1aeca6948c89): <https://commits.webkit.org/313587@main> Reviewed commits have been landed. Closing PR #65242 and removing active labels.

Note You need to log in before you can comment on or make changes to this bug.