Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 74d9ff91dbb7cac871307142a032f8cbefa72046
https://github.com/WebKit/WebKit/commit/74d9ff91dbb7cac871307142a032f8cbefa72046
Author: Yusuke Suzuki <[email protected]>
Date: 2026-09-01 (Tue, 01 Sep 2026)
Changed paths:
A JSTests/stress/megamorphic-store-frozen-prototype.js
M Source/JavaScriptCore/runtime/JSObject.cpp
Log Message:
-----------
[JSC] Object.freeze should bump megamorphic IC epoch
https://bugs.webkit.org/show_bug.cgi?id=323131
rdar://186393610
Reviewed by Keith Miller.
320236@main allows having accessors in [[Prototype]] chain. But
Object.freeze is not invalidating megamorphic IC when it is
mayBePrototype(). It needs to bump the epoch since it is changing
non read-only properties to read-only, which changes [[Put]] operation
results (setting successfully or throwing an error).
Test: JSTests/stress/megamorphic-store-frozen-prototype.js
* JSTests/stress/megamorphic-store-frozen-prototype.js: Added.
(shouldBe):
(makeShape):
(warmUp):
(Object.freeze.put):
(Object.freeze):
(shouldBe.const.proto.get other):
(shouldBe.put):
* Source/JavaScriptCore/runtime/JSObject.cpp:
(JSC::JSObject::freeze):
Canonical link: https://commits.webkit.org/320276@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
