[webkit-changes] [WebKit/WebKit] 485d48: [JSC] Additional check for transitioning for Objec...

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 485d48516a2421e5aec9d25287091f2992684884
      https://github.com/WebKit/WebKit/commit/485d48516a2421e5aec9d25287091f2992684884
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2024-01-10 (Wed, 10 Jan 2024)

  Changed paths:
    M Source/JavaScriptCore/runtime/ObjectConstructorInlines.h

  Log Message:
  -----------
  [JSC] Additional check for transitioning for Object.assign's cloning
https://bugs.webkit.org/show_bug.cgi?id=267375
rdar://120811101

Reviewed by Justin Michaud.

To ensure didTransition's invariant more strongly, we explicitly check that

1. target structure didn't do transition before.
2. source structure did transition before.

for Object.assign cloning fast path.

* Source/JavaScriptCore/runtime/ObjectConstructorInlines.h:
(JSC::objectCloneFast):

Canonical link: https://commits.webkit.org/272870@main