Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 259d2999018347dae277c3b7041abbcb4fd16a86
https://github.com/WebKit/WebKit/commit/259d2999018347dae277c3b7041abbcb4fd16a86
Author: Shu-yu Guo <[email protected]>
Date: 2026-07-23 (Thu, 23 Jul 2026)
Changed paths:
A JSTests/stress/function-bind-bound-target-tainted-structure-transition.js
M Source/JavaScriptCore/runtime/JSBoundFunction.cpp
M Source/JavaScriptCore/runtime/JSFunctionInlines.h
Log Message:
-----------
[JSC] Materialize .length/.name for bound^2 functions
https://bugs.webkit.org/show_bug.cgi?id=320017
rdar://182269995
Reviewed by Marcus Plutowski.
314682@main unified handling of bound functions (i.e. functions returned by
F.p.bind) with native functions for .length/.name materialization. This
materialization is controlled by two predicates that must be in sync:
JSBoundFunction::canSkipNameAndLengthMaterialization() used at compile-time and
JSFunction::canAssumeNameAndLengthAreOriginal() used at runtime. 314682@main
de-synced them by making JSFunction::canAssumeNameAndLengthAreOriginal() return
false for bound functions, while
JSBoundFunction::canSkipNameAndLengthMaterialization() kept returning true.
This PR re-syncs the predicates to return false for bound functions in both.
Test: JSTests/stress/function-bind-bound-target-tainted-structure-transition.js
* JSTests/stress/function-bind-bound-target-tainted-structure-transition.js:
Added.
(vm.runTaintedString.shouldBe):
(target):
(test):
* Source/JavaScriptCore/runtime/JSBoundFunction.cpp:
(JSC::JSBoundFunction::canSkipNameAndLengthMaterialization):
* Source/JavaScriptCore/runtime/JSFunctionInlines.h:
(JSC::JSFunction::canAssumeNameAndLengthAreOriginal):
Canonical link: https://commits.webkit.org/317813@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
