Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 9fc2f58ca9fcd8d0977d0805f96e6cc9785e7490
https://github.com/WebKit/WebKit/commit/9fc2f58ca9fcd8d0977d0805f96e6cc9785e7490
Author: Tadeu Zagallo <[email protected]>
Date: 2026-07-24 (Fri, 24 Jul 2026)
Changed paths:
A JSTests/stress/instanceof-prototype-change-during-compilation.js
M Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.cpp
Log Message:
-----------
[JSC] instanceof prototype-chain IC condition mismatch (release assertion)
https://bugs.webkit.org/show_bug.cgi?id=318144
rdar://180959164
Reviewed by Yusuke Suzuki.
While optimizing instanceof, we first compute the result then trigger the IC
generation.
However, the prototype chain can be mutated by user code (e.g. a Proxy
getPrototypeOf
trap or a getter) that runs while defaultHasInstance computes the instanceof
result.
When that happens, the chain walked during inline cache generation may no
longer match
the result we observed, so we can reach the prototype even though the operation
reported
a miss (shouldHit is false). In that case there is no consistent IC to build,
so bail out
and let the caller fall back to the megamorphic case instead of caching a stale
condition set.
Test: JSTests/stress/instanceof-prototype-change-during-compilation.js
* JSTests/stress/instanceof-prototype-change-during-compilation.js: Added.
(attempt.rootACtor):
(attempt.const.quietGate.get trip):
(attempt.const.noisyGate.get trip):
(attempt.hot):
(attempt.drive):
(attempt):
* Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.cpp:
(JSC::generateConditionsForInstanceOf):
Canonical link: https://commits.webkit.org/317875@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
