Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: db10a0f6167406c6b373b82f83a3bc245ed00e4b
https://github.com/WebKit/WebKit/commit/db10a0f6167406c6b373b82f83a3bc245ed00e4b
Author: Kai Tamkun <[email protected]>
Date: 2026-09-09 (Wed, 09 Sep 2026)
Changed paths:
A JSTests/stress/cached-custom-accessor-shadowed-on-flattened-dictionary.js
A JSTests/stress/cached-custom-setter-shadowed-on-flattened-dictionary.js
M Source/JavaScriptCore/bytecode/Repatch.cpp
M Source/JavaScriptCore/runtime/JSObject.cpp
M Source/JavaScriptCore/runtime/JSObject.h
M Source/JavaScriptCore/runtime/PropertySlot.h
M Source/JavaScriptCore/runtime/PutPropertySlot.h
Log Message:
-----------
[JSC] Stale IC when a custom accessor on a previously flattened dictionary is
shadowed
https://bugs.webkit.org/show_bug.cgi?id=319303
rdar://180048596
Reviewed by Yusuke Suzuki.
This patch prevents caching of custom accessors on previously flattened (i.e.,
ineligible
for future reflattening) dictionary objects. Without this, the previous value
can be
accessed even after a property change should've shadowed it.
Tests: JSTests/stress/cached-custom-accessor-shadowed-on-flattened-dictionary.js
JSTests/stress/cached-custom-setter-shadowed-on-flattened-dictionary.js
* JSTests/stress/cached-custom-accessor-shadowed-on-flattened-dictionary.js:
Added.
(assert):
(get obj):
* JSTests/stress/cached-custom-setter-shadowed-on-flattened-dictionary.js:
Added.
(assert):
(put):
* Source/JavaScriptCore/bytecode/Repatch.cpp:
(JSC::tryCacheGetBy):
(JSC::tryCachePutBy):
* Source/JavaScriptCore/runtime/JSObject.cpp:
(JSC::JSObject::putInlineSlow):
* Source/JavaScriptCore/runtime/JSObject.h:
(JSC::JSObject::getOwnNonIndexPropertySlot):
(JSC::JSObject::fillCustomGetterPropertySlot):
* Source/JavaScriptCore/runtime/PropertySlot.h:
(JSC::PropertySlot::setCacheableCustom):
* Source/JavaScriptCore/runtime/PutPropertySlot.h:
(JSC::PutPropertySlot::setCustomValue):
(JSC::PutPropertySlot::setCustomAccessor):
Canonical link: https://commits.webkit.org/320742@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
