Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8eca46ec5bfb58e4d9035036d3bbcdbb6b2a45bf
https://github.com/WebKit/WebKit/commit/8eca46ec5bfb58e4d9035036d3bbcdbb6b2a45bf
Author: Sosuke Suzuki <[email protected]>
Date: 2026-04-18 (Sat, 18 Apr 2026)
Changed paths:
A JSTests/microbenchmarks/define-properties-slow-path.js
A JSTests/stress/object-define-properties-proxy-trap-order.js
M JSTests/test262/expectations.yaml
M Source/JavaScriptCore/runtime/ObjectConstructor.cpp
Log Message:
-----------
[JSC] Fix `Object.defineProperties` Proxy trap ordering
https://bugs.webkit.org/show_bug.cgi?id=312115
Reviewed by Yusuke Suzuki.
ObjectDefineProperties [1] step 4 iterates each key returned by
[[OwnPropertyKeys]] and performs [[GetOwnProperty]] followed by Get
sequentially per key. definePropertiesSlow was passing
DontEnumPropertiesMode::Exclude to getOwnPropertyNames, which for a Proxy
invokes every getOwnPropertyDescriptor trap upfront to filter enumerable
keys before the loop runs any get trap, producing an observable ordering
difference from V8 and SpiderMonkey.
Switch to DontEnumPropertiesMode::Include and check enumerability per key
inside the loop, matching the existing pattern used by Object.assign,
entries, and values in this file. Object.create with a properties argument
shares this path and is fixed as well.
TipOfTree Patched
define-properties-all-of-keys 8.3952+-0.4725 8.1928+-0.3873
might be 1.0247x faster
define-properties-simple 6.5400+-0.3455 6.4480+-0.3268
might be 1.0143x faster
define-properties-slow-path 32.9335+-1.8871 31.2145+-1.3597
might be 1.0551x faster
[1]: https://tc39.es/ecma262/#sec-objectdefineproperties
Test: JSTests/stress/object-define-properties-proxy-trap-order.js
* JSTests/microbenchmarks/define-properties-slow-path.js: Added.
(test):
* JSTests/stress/object-define-properties-proxy-trap-order.js: Added.
(shouldBe):
(throw.new.Error.get Object):
(throw.new.Error):
(shouldBe.get Object):
(shouldBe.get let):
* JSTests/test262/expectations.yaml:
* Source/JavaScriptCore/runtime/ObjectConstructor.cpp:
(JSC::definePropertiesSlow):
Canonical link: https://commits.webkit.org/311520@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
