Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 59f9ffb4cd6d831db26878a6e097d25967fd532d
https://github.com/WebKit/WebKit/commit/59f9ffb4cd6d831db26878a6e097d25967fd532d
Author: Sosuke Suzuki <[email protected]>
Date: 2026-10-08 (Thu, 08 Oct 2026)
Changed paths:
A JSTests/stress/by-val-symbol-key-collected-in-slow-path.js
M Source/JavaScriptCore/dfg/DFGOperations.cpp
M Source/JavaScriptCore/jit/JITOperations.cpp
M Source/JavaScriptCore/runtime/Symbol.h
Log Message:
-----------
[JSC] `Symbol::privateName()` should not copy `PrivateName`
https://bugs.webkit.org/show_bug.cgi?id=326625
Reviewed by Yusuke Suzuki.
Symbol::privateName() returns PrivateName by value. PrivateName holds a
Ref<SymbolImpl>, so each call refs and derefs the SymbolImpl atomically.
The by-val slow paths for Symbol keys only need the uid for the lookup.
This patch makes Symbol::privateName() return
GCOwnedDataScope<const PrivateName&>, as JSString::value() does for
String. The scope keeps the Symbol cell alive, and the cell keeps the
SymbolImpl alive.
getByValMegamorphic called toPropertyKey() for Symbol keys, which
creates an Identifier. The subscript is always a Symbol there, so this
patch takes the uid from the Symbol directly.
Test: JSTests/stress/by-val-symbol-key-collected-in-slow-path.js
* JSTests/stress/by-val-symbol-key-collected-in-slow-path.js: Added.
(shouldBe):
(makeKey):
(get object):
(get put):
(i.get undefined):
(get getMegamorphic):
(put):
* Source/JavaScriptCore/dfg/DFGOperations.cpp:
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/jit/JITOperations.cpp:
(JSC::getByValMegamorphic):
* Source/JavaScriptCore/runtime/Symbol.h:
Canonical link: https://commits.webkit.org/323079@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
