Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 418114c05c3e178526ec293a4b1844796152160a
https://github.com/WebKit/WebKit/commit/418114c05c3e178526ec293a4b1844796152160a
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-14 (Mon, 14 Sep 2026)
Changed paths:
A JSTests/modules/import-cycle-function-linked-before-module-code.js
A JSTests/modules/import-cycle-function-linked-before-module-code/1.js
A JSTests/modules/import-cycle-function-linked-before-module-code/2.js
M Source/JavaScriptCore/runtime/JSScope.cpp
Log Message:
-----------
[JSC] DFG folds a module variable to a stale value after an import cycle
https://bugs.webkit.org/show_bug.cgi?id=324124
Reviewed by Yusuke Suzuki.
When an import cycle lets another module call a module's exported
function before that module's own code has been linked, DFG can fold a
variable of that module to a constant and keep using the first value
after the function has written to the variable.
DFG folds a closure variable while the WatchpointSet of its
SymbolTableEntry is IsWatched. A ClosureVar put_to_scope does not touch
the set on each write. Linking it invalidates the set once instead. The
set is created lazily, when the code declaring the variable links its
ResolvedClosureVar put. A module's environment and SymbolTable exist
before the module code is linked, so a function linked first finds no
set and invalidates nothing. The module code then creates the set, its
first write makes the set IsWatched, and nothing invalidates it later.
This patch makes abstractAccess create the set when it resolves a put to
ClosureVar, so linking the put invalidates the set in either order.
Tests: JSTests/modules/import-cycle-function-linked-before-module-code.js
JSTests/modules/import-cycle-function-linked-before-module-code/1.js
JSTests/modules/import-cycle-function-linked-before-module-code/2.js
* JSTests/modules/import-cycle-function-linked-before-module-code.js: Added.
* JSTests/modules/import-cycle-function-linked-before-module-code/1.js: Added.
(export.addLexical):
(export.readLexical):
(export.addLexicalThreeTimes):
(export.addHoisted):
(export.readHoisted):
* JSTests/modules/import-cycle-function-linked-before-module-code/2.js: Added.
(shouldThrow):
* Source/JavaScriptCore/runtime/JSScope.cpp:
(JSC::abstractAccess):
Canonical link: https://commits.webkit.org/321135@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
