Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: cd30bb7e410f12481f5330a896e72cd569eb7ee2
https://github.com/WebKit/WebKit/commit/cd30bb7e410f12481f5330a896e72cd569eb7ee2
Author: Yusuke Suzuki <[email protected]>
Date: 2026-09-02 (Wed, 02 Sep 2026)
Changed paths:
A JSTests/stress/object-create-check-insertion.js
M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
Log Message:
-----------
[JSC] ObjectCreate folding should emit checks
https://bugs.webkit.org/show_bug.cgi?id=317570
rdar://178248992
Reviewed by Yijia Huang.
When folding ObjectCreate(with-edge-checks), we are not emitting these
checks and converting it to NewObject. As a result, we missed the edge
filters and the subsequent code may rely on that. This patch correctly
inserts these checks.
Test: JSTests/stress/object-create-check-insertion.js
* JSTests/stress/object-create-check-insertion.js: Added.
(bitsToDouble):
(enforce):
(getKey):
(getK2):
(caller):
(trainGetKey):
(trainCaller):
(trainGetK2):
(ramp):
* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
Originally-landed-as: [email protected] (ac9e40a7195b).
rdar://185368518
Canonical link: https://commits.webkit.org/320366@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
