Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 7225cf04ea3d003ba0698f620a447be04902fd34
https://github.com/WebKit/WebKit/commit/7225cf04ea3d003ba0698f620a447be04902fd34
Author: Alexey Shvayka <[email protected]>
Date: 2023-07-31 (Mon, 31 Jul 2023)
Changed paths:
A JSTests/stress/regress-108468977.js
M Source/JavaScriptCore/bytecode/PropertyCondition.cpp
M Source/JavaScriptCore/runtime/JSObject.cpp
M Source/JavaScriptCore/runtime/JSObject.h
Log Message:
-----------
[JSC] PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint()
should take all put() overrides into account
https://bugs.webkit.org/show_bug.cgi?id=257271
<rdar://108468977>
Reviewed by Yusuke Suzuki.
Currently, PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint() is
not taking into account
all existing put() overrides when analyzing side effects of AbsenceOfSetEffect
condition, which leads
to incorrect results for e.g. StringObject's "length", which is no-op in sloppy
mode yet we rely on
structure being transitioned.
This patch fixes AbsenceOfSetEffect validity check to be more pessimistic when
there is overriden put(),
unless it's a common assigment target like JSArray or JSFunction to avoid
performance regressions,
all while the helper that checks for special properties with
JSObject::definePropertyOnReceiver().
* JSTests/stress/regress-108468977.js: Added.
* Source/JavaScriptCore/bytecode/PropertyCondition.cpp:
(JSC::PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint const):
(JSC::nonStructurePropertyMayBecomeReadOnlyWithoutTransition): Deleted.
* Source/JavaScriptCore/runtime/JSObject.cpp:
(JSC::JSObject::mightBeSpecialProperty):
(JSC::JSObject::definePropertyOnReceiver):
(JSC::canDefinePropertyOnReceiverFast): Deleted.
* Source/JavaScriptCore/runtime/JSObject.h:
Originally-landed-as: 259548.797@safari-7615-branch (169a4b7e3f48).
rdar://108468977
Canonical link: https://commits.webkit.org/266436@main
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
