Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 41776a35d9581136117d35408f907e6bbc869632
https://github.com/WebKit/WebKit/commit/41776a35d9581136117d35408f907e6bbc869632
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-02 (Wed, 02 Sep 2026)
Changed paths:
A JSTests/stress/megamorphic-store-prototype-dictionary-delete.js
M Source/JavaScriptCore/runtime/JSObject.cpp
Log Message:
-----------
[JSC] Deleting a property of a dictionary prototype in place does not
invalidate the megamorphic store cache
https://bugs.webkit.org/show_bug.cgi?id=323254
Reviewed by Yusuke Suzuki.
Deleting a property from an object whose Structure is an UncacheableDictionary
removes it in place, so the StructureID does not change.
JSObject::deleteProperty
only bumped the megamorphic cache epoch on the transition path, so a store cache
entry that was recorded while a prototype shadowed a setter or a read-only
property stays valid after that shadowing property is deleted, and later stores
add an own property instead of calling the setter or throwing. Before
320236@main
such chains were never recorded in the store cache, which hid the missing bump.
Bump the epoch on both delete paths, matching the in-place add and attribute
change paths, which already invalidate without a transition.
Test: JSTests/stress/megamorphic-store-prototype-dictionary-delete.js
* JSTests/stress/megamorphic-store-prototype-dictionary-delete.js: Added.
(shouldBe):
(makeShape):
(makeChain):
(put):
(i.put.makeShape.const.P2.set x):
(i.put.makeShape):
* Source/JavaScriptCore/runtime/JSObject.cpp:
(JSC::JSObject::deleteProperty):
Canonical link: https://commits.webkit.org/320375@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
