Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: fb8bfead603ee6308af1dbfb0619cbaa40f79dee
https://github.com/WebKit/WebKit/commit/fb8bfead603ee6308af1dbfb0619cbaa40f79dee
Author: Kai Tamkun <[email protected]>
Date: 2026-05-20 (Wed, 20 May 2026)
Changed paths:
A JSTests/stress/spread-set-own-symbol-iterator-side-effects.js
M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
Log Message:
-----------
[JSC] incorrect side-effect modeling for Spread(SetObjectUse) in DFG abstract
interpreter
https://bugs.webkit.org/show_bug.cgi?id=315132
rdar://177136593
Reviewed by Yusuke Suzuki.
313031@main allows Set spreads to invoke user-defined `Symbol.iterator`
functions.
This broke an assumption in the abstract interpreter that spreading a Set object
has no side effects, and under that assumption the AI had been keeping structure
proofs alive, even though now the call to a user-defined `Symbol.iterator`
function
during the spread could change the structure. A subsequent GetByOffset, which
should've been prevented by an OSR exit during the CheckStructure that was being
mistakenly folded, could then read a stale slot.
Test: JSTests/stress/spread-set-own-symbol-iterator-side-effects.js
* JSTests/stress/spread-set-own-symbol-iterator-side-effects.js: Added.
(shouldBe):
(set o):
(f):
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
Canonical link: https://commits.webkit.org/313614@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
