Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 78c04ea7a1bc88f883951d5b5a1ad75dd4676e4e
https://github.com/WebKit/WebKit/commit/78c04ea7a1bc88f883951d5b5a1ad75dd4676e4e
Author: Shu-yu Guo <[email protected]>
Date: 2026-05-29 (Fri, 29 May 2026)
Changed paths:
A JSTests/stress/dfg-ensure-absence-own-then-property.js
M Source/JavaScriptCore/dfg/DFGGraph.cpp
Log Message:
-----------
[JSC] Check initial object structure in tryEnsureAbsence in DFG
https://bugs.webkit.org/show_bug.cgi?id=310578
rdar://173052986
Reviewed by Yijia Huang.
In DFG, tryEnsureAbsence currently does not check the structure of the object
on which it's trying to generate the conditions that a property remains absent.
It only checks the structures of the objects on the prototype chain. This is
incorrect in the case where object itself contains the property we're trying to
ensure absence of.
Test: JSTests/stress/dfg-ensure-absence-own-then-property.js
* JSTests/stress/dfg-ensure-absence-own-then-property.js: Added.
(createObject1):
(createObject2):
(opt):
(main):
* Source/JavaScriptCore/dfg/DFGGraph.cpp:
(JSC::DFG::Graph::tryEnsureAbsence):
Originally-landed-as: 305413.567@rapid/safari-7624.2.5.110-branch
(eaf1fed3279c). rdar://176061662
Canonical link: https://commits.webkit.org/314147@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
