Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 9b61fb4887c1382b9f7918b6bed67d2a5e241ea2
https://github.com/WebKit/WebKit/commit/9b61fb4887c1382b9f7918b6bed67d2a5e241ea2
Author: Sosuke Suzuki <[email protected]>
Date: 2026-10-11 (Sun, 11 Oct 2026)
Changed paths:
A JSTests/stress/by-val-megamorphic-key-collected-in-slow-path.js
M Source/JavaScriptCore/jit/JITOperations.cpp
Log Message:
-----------
[JSC] `putByValMegamorphic` and `inByValMegamorphic` should not create
`Identifier`
https://bugs.webkit.org/show_bug.cgi?id=327083
Reviewed by Yusuke Suzuki.
putByValMegamorphic and inByValMegamorphic call toPropertyKey() to get
the uid of the subscript. This creates an Identifier, which refs and
derefs the StringImpl atomically. The subscript is always an atom
string or a Symbol there, and only the uid is used.
This patch takes the uid with CacheableIdentifier::getCacheableIdentifier()
instead. It returns the uid in a GCOwnedDataScope, which keeps the cell
alive, and it cannot throw. getByValMegamorphic creates no Identifier
since 323079@main, but it is changed to the same form.
Test: JSTests/stress/by-val-megamorphic-key-collected-in-slow-path.js
* JSTests/stress/by-val-megamorphic-key-collected-in-slow-path.js: Added.
(shouldBe):
(const.handler.get has):
(makeKey):
(get put):
(has):
* Source/JavaScriptCore/jit/JITOperations.cpp:
(JSC::inByValMegamorphic):
(JSC::putByValMegamorphic):
(JSC::getByValMegamorphic):
Canonical link: https://commits.webkit.org/323381@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
