Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 1566615170ec213c8f5c9188609d7b03fe245118
https://github.com/WebKit/WebKit/commit/1566615170ec213c8f5c9188609d7b03fe245118
Author: Sosuke Suzuki <[email protected]>
Date: 2026-07-30 (Thu, 30 Jul 2026)
Changed paths:
A
JSTests/stress/for-in-enumerator-hole-with-inherited-index-custom-prototype.js
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
Log Message:
-----------
[JSC] `EnumeratorNextUpdateIndexAndMode` should require the original array
structure before using `InBoundsSaneChain`
https://bugs.webkit.org/show_bug.cgi?id=320620
Reviewed by Yusuke Suzuki and Keith Miller.
The sane-chain speculation for the indexed enumerator mode was guarded
only by benefitsFromOriginalArray(), which checks the indexing type but
not the array class. As a result an array with a custom prototype got
InBoundsSaneChain and DFG/FTL skipped hole checks against the prototype,
diverging from LLInt/baseline. Check isJSArrayWithOriginalStructure()
first, like every other sane-chain site in fixup does.
Test:
JSTests/stress/for-in-enumerator-hole-with-inherited-index-custom-prototype.js
*
JSTests/stress/for-in-enumerator-hole-with-inherited-index-custom-prototype.js:
Added.
(shouldBe):
(mutate):
(test):
(makeArray):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
Canonical link: https://commits.webkit.org/318293@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
