Bug 256551 (CVE-2023-41074)

Summary: [JSC] Refine Object.create modeling in DFG after mayBePrototype bit is mored to Structure
Product: WebKit Reporter: Yusuke Suzuki <ysuzuki>
Component: JavaScriptCoreAssignee: Yusuke Suzuki <ysuzuki>
Status: RESOLVED FIXED    
Severity: Normal CC: mcatanzaro, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   

Description Yusuke Suzuki 2023-05-09 14:35:17 PDT
...
Comment 1 Yusuke Suzuki 2023-05-09 14:35:19 PDT
<rdar://problem/109045428>
Comment 2 Yusuke Suzuki 2023-05-09 14:37:18 PDT
Pull request: https://github.com/WebKit/WebKit/pull/13658
Comment 3 EWS 2023-05-09 18:50:42 PDT
Committed 263889@main (d60bafb0be1b): <https://commits.webkit.org/263889@main>

Reviewed commits have been landed. Closing PR #13658 and removing active labels.