Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ae0b70efbe6b5326518eef3160144494748d8b11
https://github.com/WebKit/WebKit/commit/ae0b70efbe6b5326518eef3160144494748d8b11
Author: Justin Michaud <[email protected]>
Date: 2023-11-01 (Wed, 01 Nov 2023)
Changed paths:
A JSTests/stress/reflect-construct-reenter-prototype-get-different-global.js
A JSTests/stress/reflect-construct-reenter-prototype-get.js
M Source/JavaScriptCore/runtime/InternalFunction.cpp
Log Message:
-----------
Reflect.construct can churn cached internalFunctionAllocationStructure
https://bugs.webkit.org/show_bug.cgi?id=263945
rdar://117556294
Reviewed by Keith Miller.
Reviewed by Mark Lam.
Reflect.construct can churn the cached internalFunctionAllocationStructure
when calling the target's prototype getter, causing us to fail a debug assert.
This isn't really a problem though, since accidentally making a second structure
shouldn't break anything (like our watchpoints or structure transition logic).
We just add an extra check to silence the debug assert and be slightly more
optimal.
* JSTests/stress/reflect-construct-reenter-prototype-get-different-global.js:
Added.
(newTarget):
(get let):
* JSTests/stress/reflect-construct-reenter-prototype-get.js: Added.
(newTarget):
(get let):
* Source/JavaScriptCore/runtime/InternalFunction.cpp:
(JSC::InternalFunction::createSubclassStructure):
Canonical link: https://commits.webkit.org/270084@main
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
