Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: a5bfdb3aaf30433058dc5b318d82f1dd7b9e4584
https://github.com/WebKit/WebKit/commit/a5bfdb3aaf30433058dc5b318d82f1dd7b9e4584
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-16 (Wed, 16 Sep 2026)
Changed paths:
A JSTests/stress/error-stack-trace-limit-hot-assignment.js
A JSTests/stress/error-stack-trace-limit-own-data-property.js
A JSTests/wasm/stress/exception-trace-stack-limit-own-data-property.js
M Source/JavaScriptCore/runtime/Error.cpp
M Source/JavaScriptCore/runtime/ErrorConstructor.cpp
M Source/JavaScriptCore/runtime/ErrorConstructor.h
M Source/JavaScriptCore/runtime/JSGlobalObject.cpp
M Source/JavaScriptCore/runtime/JSGlobalObject.h
Log Message:
-----------
[JSC] Read `Error.stackTraceLimit` from the `Error` constructor when
capturing a stack
https://bugs.webkit.org/show_bug.cgi?id=324314
Reviewed by Keith Miller.
In current JSC, the limit used to truncate error.stack has lived in a
C++ field that ErrorConstructor::put and deleteProperty copy from the
Error.stackTraceLimit property. Any write that bypasses them leaves the
field stale: a put_by_id inline cache (put does not disable caching),
Object.defineProperty, TypeError.stackTraceLimit = n, and so on. A hot
`Error.stackTraceLimit = n` site stops taking effect once it tiers up.
Drop the field and the two overrides, and make
JSGlobalObject::stackTraceLimit() read the Error constructor's own data
property with getDirect() when a stack is captured. This is what V8 does,
and leaves nothing to keep in sync.
The cost is one property table lookup per capture (about 3 ns per
`new Error()` locally), small next to walking the frames.
TypeError.stackTraceLimit = n and assignment through an accessor installed
on stackTraceLimit no longer change the limit, both matching V8.
Tests: JSTests/stress/error-stack-trace-limit-hot-assignment.js
JSTests/stress/error-stack-trace-limit-own-data-property.js
JSTests/wasm/stress/exception-trace-stack-limit-own-data-property.js
* JSTests/stress/error-stack-trace-limit-hot-assignment.js: Added.
(shouldBe):
(recurse):
(frameCount):
(shouldCheck):
(readLimit):
(setLimit):
(setLimitAndCapture):
(i.shouldCheck):
* JSTests/stress/error-stack-trace-limit-own-data-property.js: Added.
(shouldBe):
(recurse):
(frameCount):
(captureStackTraceAt):
(DerivedError):
* JSTests/wasm/stress/exception-trace-stack-limit-own-data-property.js: Added.
(recurse):
(frameCount):
* Source/JavaScriptCore/runtime/Error.cpp:
(JSC::getStackTrace):
* Source/JavaScriptCore/runtime/ErrorConstructor.cpp:
(JSC::ErrorConstructor::finishCreation):
(JSC::ErrorConstructor::put): Deleted.
(JSC::ErrorConstructor::deleteProperty): Deleted.
* Source/JavaScriptCore/runtime/ErrorConstructor.h:
* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::JSGlobalObject):
(JSC::JSGlobalObject::stackTraceLimit const):
* Source/JavaScriptCore/runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::stackTraceLimit const): Deleted.
(JSC::JSGlobalObject::setStackTraceLimit): Deleted.
Canonical link: https://commits.webkit.org/321296@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
