← WebKit — 2026-W41
4dab012045bc4bc42306a382e561a70eade247e6 [JSC] Read Object.defineProperty descriptor fields after ToPropertyKey
severity medium
class TypeConfusion
confidence 0.35
signal score 8.17
Source/JavaScriptCore/dfg
Primitive: DFG constant-folding of ObjectDefineProperty with an object-typed key
Triage note: DFGConstantFoldingPhase now guards with canFoldKey (bails when the key edge may be SpecObject) and preserves keyEdge.useKind(), with FixupPhase speculating String/Symbol/Int32/Number key types and matching DFG/FTL backend lowering; primarily a JIT property-key specialization/optimization whose SpecObject guard adds correctness, no concrete exploit shown in-diff.
Triage note: DFGConstantFoldingPhase now guards with canFoldKey (bails when the key edge may be SpecObject) and preserves keyEdge.useKind(), with FixupPhase speculating String/Symbol/Int32/Number key types and matching DFG/FTL backend lowering; primarily a JIT property-key specialization/optimization whose SpecObject guard adds correctness, no concrete exploit shown in-diff.
Structural signals: security_assert (+6.47), null_guard (+1.2), area:Source/JavaScriptCore/dfg (+2.5), large_churn (-2.0)
Commit message
[JSC] Read Object.defineProperty descriptor fields after ToPropertyKey
https://bugs.webkit.org/show_bug.cgi?id=316774
Reviewed by Yusuke Suzuki.
DFG and FTL lowered Object.defineProperty by loading descriptor fields
before converting the key. An object key's toString could change those
fields and the fast path still defined the old value. Fixup selects a
string, symbol, int32, or number use kind for that key. Constant folding
and the abstract interpreter both read it, and only that proved
non-object key keeps the fast path. The DFG fast path keeps that key
register live until the scratch buffer and the descriptor loads are
allocated.
* JSTests/stress/object-define-property-key-before-descriptor.js:
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter::executeEffects):
* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileDefineDataProperty):
(JSC::DFG::SpeculativeJIT::compileDefineAccessorProperty):
(JSC::DFG::SpeculativeJIT::compileObjectDefineProperty):
(JSC::DFG::SpeculativeJIT::compileObjectDefinePropertyFromFields):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::LowerDFGToB3::lowEncodedPropertyKey):
(JSC::FTL::LowerDFGToB3::compileDefineDataProperty):
(JSC::FTL::LowerDFGToB3::compileDefineAccessorProperty):
(JSC::FTL::LowerDFGToB3::compileObjectDefineProperty):
(JSC::FTL::LowerDFGToB3::compileObjectDefinePropertyFromFields):
Canonical link: https://commits.webkit.org/322982@main
Before / after
Loading diff…
On This Page