Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: f641af0b8e472dd959f5e0763e18a68072bfca6e
https://github.com/WebKit/WebKit/commit/f641af0b8e472dd959f5e0763e18a68072bfca6e
Author: Keith Miller <[email protected]>
Date: 2026-08-07 (Fri, 07 Aug 2026)
Changed paths:
A JSTests/stress/array-unshift-moved-cell-barrier.js
M Source/JavaScriptCore/dfg/DFGStoreBarrierInsertionPhase.cpp
Log Message:
-----------
Add missing writeBarrier to Array.unshift
https://bugs.webkit.org/show_bug.cgi?id=321217
rdar://183142160
Reviewed by Yusuke Suzuki.
In 313475@main we added support for Array.p.unshift in the DFG based on
Array.push. Unlike Array.push, when relocating elements they may become
invisible to the GC. Since we inline the case where there is exactly
one element being prepended to the array and we don't know what the
contents of the array are we always have to writeBarrier the array.
Test: JSTests/stress/array-unshift-moved-cell-barrier.js
Canonical link: https://commits.webkit.org/318780@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
