Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 731652af64ff40f6fd4063d6e1969ed25b1df9c1
https://github.com/WebKit/WebKit/commit/731652af64ff40f6fd4063d6e1969ed25b1df9c1
Author: Yusuke Suzuki <[email protected]>
Date: 2026-09-01 (Tue, 01 Sep 2026)
Changed paths:
A JSTests/stress/proxy-handler-traps-cache-poly-proto-handler.js
M Source/JavaScriptCore/jit/JITOperations.cpp
M Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
M Source/JavaScriptCore/runtime/ProxyObject.cpp
M Source/JavaScriptCore/runtime/ProxyObject.h
Log Message:
-----------
[JSC] Fix Structure transition wrong checking issues
https://bugs.webkit.org/show_bug.cgi?id=323085
rdar://186339983
Reviewed by Marcus Plutowski and Keith Miller.
Adding MonoProto condition to isHandlerPrototypeChainCacheable.
Otherwise we may get a structure which has differnt [[Prototype]] (due
to PolyProto). In that case, worst case is having jsNull as a JSObject*,
so crash issue with a deterministic address. Also updating oldStructure
by passing it to CommonSlowPaths::putDirectWithReify. This is not an
actual issue, but it makes oldStructure more solid.
Test: JSTests/stress/proxy-handler-traps-cache-poly-proto-handler.js
* JSTests/stress/proxy-handler-traps-cache-poly-proto-handler.js: Added.
(shouldBe):
(makePolyProtoObject.foo.C):
(makePolyProtoObject.foo):
(return.foo):
(shouldBe.handler):
* Source/JavaScriptCore/jit/JITOperations.cpp:
(JSC::directPutByValOptimize):
* Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* Source/JavaScriptCore/runtime/ProxyObject.cpp:
(JSC::ProxyObject::getHandlerTrap):
* Source/JavaScriptCore/runtime/ProxyObject.h:
(JSC::ProxyObject::isHandlerTrapsCacheValid):
Canonical link: https://commits.webkit.org/320251@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
