Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d75a9fda98e0e3033e8e7060fd341f0bf1c01d21
https://github.com/WebKit/WebKit/commit/d75a9fda98e0e3033e8e7060fd341f0bf1c01d21
Author: Shu-yu Guo <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A JSTests/stress/dfg-ensure-absence-cached-dictionary-then.js
M Source/JavaScriptCore/dfg/DFGGraph.cpp
M Source/JavaScriptCore/runtime/Structure.h
Log Message:
-----------
[JSC] Do not cache property absence on dictionaries
https://bugs.webkit.org/show_bug.cgi?id=313265
rdar://175520268
Reviewed by Yusuke Suzuki.
Structures with CachedDictionaryKind can add new properties without
transitioning structures. Therefore, property absences are not cacheable. This
PR fixes a bug in DFG which incorrectly caches property absences on structures
with CachedDictionaryKind.
Test: JSTests/stress/dfg-ensure-absence-cached-dictionary-then.js
* JSTests/stress/dfg-ensure-absence-cached-dictionary-then.js: Added.
(createObject1):
(createObject2):
(opt):
(main):
* Source/JavaScriptCore/dfg/DFGGraph.cpp:
(JSC::DFG::Graph::tryEnsureAbsence):
* Source/JavaScriptCore/runtime/Structure.h:
(JSC::Structure::propertyAccessesAreCacheableForAbsence):
Originally-landed-as: 305413.731@safari-7624-branch (343b8326d944).
rdar://180437776
Canonical link: https://commits.webkit.org/316189@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
