RESOLVED FIXED315143
DFG abstract interpreter misclassifies ArraySortCompact result as SpecObjectOther instead of SpecCellOther 
https://bugs.webkit.org/show_bug.cgi?id=315143
Summary DFG abstract interpreter misclassifies ArraySortCompact result as SpecObjectO...
anand_srinivasan
Reported 2026-05-19 16:57:28 PDT
rdar://177361524 ArraySortCompact returns a JSCellButterfly but DFG abstract interpreter marks the node as SpecObjectOther instead of SpecCellOther even though a JSCell is not necessarily a JSObject.
Attachments
Add attachment proposed patch, testcase, etc.
anand_srinivasan
Comment 1 2026-05-19 17:17:14 PDT
Pull request: https://github.com/WebKit/WebKit/pull/65242
EWS
Comment 2 2026-05-20 11:16:42 PDT
Committed 313587@main (1aeca6948c89): <https://commits.webkit.org/313587@main> Reviewed commits have been landed. Closing PR #65242 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.