← WebKit — 2026-W41
7fbbbd1f450b34c85e0ad90024af44dcf1ef2802 [JSC] Remove redundant work from FTL object and array access lowering
not a security fix
confidence 0.18
signal score 10.09
Source/JavaScriptCore/ftl
Classified as not security-relevant.
Triage note: A collection of FTL optimizations: skip the boxPath for double-result GetByVal, fold the |this| +1 into the varargs load offset, add usually/rarely branch weights, hoist a shared baseButterfly load for MultiGetByOffset/MultiPutByOffset, and a MatchStructure fast path. These read as performance/codegen changes; no specific miscompilation/type-confusion bug is pinned by the diff.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Triage note: A collection of FTL optimizations: skip the boxPath for double-result GetByVal, fold the |this| +1 into the varargs load offset, add usually/rarely branch weights, hoist a shared baseButterfly load for MultiGetByOffset/MultiPutByOffset, and a MatchStructure fast path. These read as performance/codegen changes; no specific miscompilation/type-confusion bug is pinned by the diff.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Structural signals: bounds_guard (+2.0), null_guard (+2.59), msg_strong (+3.0), area:Source/JavaScriptCore/ftl (+2.5)
Before / after
Loading diff…
On This Page