Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 485d48516a2421e5aec9d25287091f2992684884
https://github.com/WebKit/WebKit/commit/485d48516a2421e5aec9d25287091f2992684884
Author: Yusuke Suzuki <ysuz...@apple.com>
Date: 2024-01-10 (Wed, 10 Jan 2024)
Changed paths:
M Source/JavaScriptCore/runtime/ObjectConstructorInlines.h
Log Message:
-----------
[JSC] Additional check for transitioning for Object.assign's cloning
https://bugs.webkit.org/show_bug.cgi?id=267375
rdar://120811101
Reviewed by Justin Michaud.
To ensure didTransition's invariant more strongly, we explicitly check that
1. target structure didn't do transition before.
2. source structure did transition before.
for Object.assign cloning fast path.
* Source/JavaScriptCore/runtime/ObjectConstructorInlines.h:
(JSC::objectCloneFast):
Canonical link: https://commits.webkit.org/272870@main
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
