Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 51a07f95fdd21e0081de695b946f55bb80a92090
https://github.com/WebKit/WebKit/commit/51a07f95fdd21e0081de695b946f55bb80a92090
Author: Shu-yu Guo <[email protected]>
Date: 2026-09-21 (Mon, 21 Sep 2026)
Changed paths:
A JSTests/stress/spread-set-cross-realm-symbol-iterator-side-effects.js
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Log Message:
-----------
[JSC] Fix cross-realm DFG Set spread optimization
https://bugs.webkit.org/show_bug.cgi?id=321705
rdar://184821678
Reviewed by Keith Miller and Mark Lam.
The DFG optimization for spreading a Set depends on the Set iterator protocol
being intact. This is guarded by a watchpoint. This watchpoint is armed on the
global of the set itself, which is node->child1(). Subsequent optimization
passes incorrectly depends on the Set structure of node, which corresponds to
the spread operation itself and may be in a different realm than the set.
This PR fixes this by using child1() everywhere to determine the global.
Test: JSTests/stress/spread-set-cross-realm-symbol-iterator-side-effects.js
* JSTests/stress/spread-set-cross-realm-symbol-iterator-side-effects.js: Added.
(shouldBe):
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileSpread):
Originally-landed-as: 316606.361@safari-7625-branch (62860f03b72a).
rdar://187507225
Canonical link: https://commits.webkit.org/321540@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
