Bug 135782

Summary: for-in optimization should also make sure the base matches the object being iterated
Product: WebKit Reporter: Mark Hahnenberg <mhahnenberg>
Component: JavaScriptCoreAssignee: Mark Hahnenberg <mhahnenberg>
Status: RESOLVED FIXED    
Severity: Normal CC: fpizlo, ggaren, mark.lam
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on: 135812    
Bug Blocks:    
Attachments:
Description Flags
Patch
none
Patch none

Description Mark Hahnenberg 2014-08-08 18:21:22 PDT 
Fix on its way...
Comment 1 Mark Hahnenberg 2014-08-08 18:23:45 PDT 
Created attachment 236329 [details]
Patch
Comment 2 Mark Hahnenberg 2014-08-08 23:00:43 PDT 
Created attachment 236331 [details]
Patch
Comment 3 Geoffrey Garen 2014-08-11 11:25:48 PDT 
Comment on attachment 236331 [details]
Patch

r=me
Comment 4 WebKit Commit Bot 2014-08-11 12:00:04 PDT 
Comment on attachment 236331 [details]
Patch

Clearing flags on attachment: 236331

Committed r172401: <http://trac.webkit.org/changeset/172401>
Comment 5 WebKit Commit Bot 2014-08-11 12:00:07 PDT 
All reviewed patches have been landed.  Closing bug.
Comment 7 Mark Lam 2014-08-11 12:49:40 PDT 
Looks like this is not just a 32-bit issue: http://build.webkit.org/builders/Apple%20Mavericks%20Release%20WK1%20%28Tests%29/builds/7945
Comment 8 WebKit Commit Bot 2014-08-11 12:56:51 PDT 
Re-opened since this is blocked by bug 135812
Comment 9 Mark Lam 2014-08-11 13:17:10 PDT 
Looks like there's a bug in the test.  "for (var p in a) {" should be "for (var p in b) {".  Currently re-testing before re-landing.
Comment 10 Geoffrey Garen 2014-08-11 14:47:05 PDT 
<rdar://problem/17793974>
Comment 11 Geoffrey Garen 2014-08-11 14:47:19 PDT 
Sorry, ignore that Radar link.
Comment 12 Mark Lam 2014-08-11 15:01:09 PDT 
Patch re-landed in r172413: <http://trac.webkit.org/r172413>.
Comment 13 Filip Pizlo 2014-08-18 18:32:35 PDT 
This was a 50% regression on string-fasta.