[20] [JSC] DFG object allocation sinking shouldn't insert a check when given a PutByVal

Severity: Medium | Component: JSC DFG JIT | cdfa73f

Rated Medium because the diff removes a vestigial special-case in DFG allocation sinking that emitted IR violating the current graph invariants. In --validateGraph builds it tripped a GetButterfly validator rule; in release builds the miscompiled graph may reach later phases with inconsistent exit-state metadata.

A leftover if (node->op() == PutByVal) block in ObjectAllocationSinkingPhase::run() inserted a Check on the stored value before the synthesized PutHint. The block was a fix for a now-replaced array-sinking implementation and no longer matches the surrounding code's invariants.

Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp / DFGValidate.cpp

-                       if (node->op() == PutByVal) {
-                           Edge value = m_graph.varArgChild(node, 2);
-                           m_insertionSet.insertNode(nodeIndex + 1, SpecNone, Check, node->origin, Edge(value.node(), value.useKind()));
-                       }

-                case GetButterfly:
-                    VALIDATE((node), !node->child1()->isPhantomAllocation());
-                    break;

Stale optimization-phase code path emitting nodes that violate the current DFG graph invariants after a surrounding algorithm was replaced.

The GetButterfly validator rule is dropped alongside, indicating the surrounding allocation-sinking machinery now legitimately produces shapes the old validator forbade.

The regression test runs a trivial array-store loop under --validateGraphAtEachPhase=1 --validateGraph=true, characteristic of either a fuzzer minimization or an internal validation-driven crash. The fix is classified by Apple as security-relevant per the commit's stated rdar/backport metadata, though the diff itself only demonstrates that the phase emitted graph shapes the validator forbade; downstream release-build consequences are not directly visible.

This vulnerability weakens DFG compiler correctness guarantees inside the renderer. The pre-fix code allowed the phase to emit a graph that violated DFG validation invariants, meaning later phases could operate on inconsistent IR.

Audit directions

Vestigial node-insertion left over from replaced compiler phases. git log -p on DFGObjectAllocationSinkingPhase.cpp and DFGValidate.cpp for guard blocks whose comments cite removed algorithms. Grep for single-opcode if (node->op() == ...) branches inside generic loops.
Phase-emitted nodes whose exit-state clobberization must match the insertion site. Audit every Check/CheckInBounds/Phantom insertion in ObjectAllocationSinkingPhase, ArgumentsEliminationPhase, PutStackSinkingPhase.
DFG validator rules deleted concurrently with phase fixes. Verify the relaxation is justified by IR semantics, not silenced by the immediate fix.