Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 4dab012045bc4bc42306a382e561a70eade247e6
https://github.com/WebKit/WebKit/commit/4dab012045bc4bc42306a382e561a70eade247e6
Author: Sergey Rubanov <[email protected]>
Date: 2026-10-07 (Wed, 07 Oct 2026)
Changed paths:
A JSTests/stress/object-define-property-key-before-descriptor.js
M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Log Message:
-----------
[JSC] Read Object.defineProperty descriptor fields after ToPropertyKey
https://bugs.webkit.org/show_bug.cgi?id=316774
Reviewed by Yusuke Suzuki.
DFG and FTL lowered Object.defineProperty by loading descriptor fields
before converting the key. An object key's toString could change those
fields and the fast path still defined the old value. Fixup selects a
string, symbol, int32, or number use kind for that key. Constant folding
and the abstract interpreter both read it, and only that proved
non-object key keeps the fast path. The DFG fast path keeps that key
register live until the scratch buffer and the descriptor loads are
allocated.
* JSTests/stress/object-define-property-key-before-descriptor.js:
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter::executeEffects):
* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileDefineDataProperty):
(JSC::DFG::SpeculativeJIT::compileDefineAccessorProperty):
(JSC::DFG::SpeculativeJIT::compileObjectDefineProperty):
(JSC::DFG::SpeculativeJIT::compileObjectDefinePropertyFromFields):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::LowerDFGToB3::lowEncodedPropertyKey):
(JSC::FTL::LowerDFGToB3::compileDefineDataProperty):
(JSC::FTL::LowerDFGToB3::compileDefineAccessorProperty):
(JSC::FTL::LowerDFGToB3::compileObjectDefineProperty):
(JSC::FTL::LowerDFGToB3::compileObjectDefinePropertyFromFields):
Canonical link: https://commits.webkit.org/322982@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
