Bug 174923

Summary: ScopedArguments overflow storage needs to be in the JSValue gigacage
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: ggaren, jfbastien, keith_miller, mark.lam, msaboff, saam, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: All   
OS: All   
Bug Depends on: 174919    
Bug Blocks: 174917    
Attachments:
Description Flags
the patch saam: review+

Description Filip Pizlo 2017-07-27 19:46:22 PDT 
...
Comment 1 Filip Pizlo 2017-08-11 18:08:35 PDT 
Created attachment 317982 [details]
the patch
Comment 2 Saam Barati 2017-08-12 11:13:21 PDT 
Comment on attachment 317982 [details]
the patch

r=me
Does polymorphic access also access scoped arguments for “length”?
Comment 3 Filip Pizlo 2017-08-12 11:39:28 PDT 
(In reply to Saam Barati from comment #2)
> Comment on attachment 317982 [details]
> the patch
> 
> r=me
> Does polymorphic access also access scoped arguments for “length”?

Yeah.  Since that's not an indexed access, we don't have to do caging there.  We could do it, but then we'd be wagging the dog.

The objective here is to make indexed accesses never go outside of a cage.

Therefore, we but the object being accessed into a cage.

This does not mean that all non-indexed accesses to that object need caging.  I don't think that the upside of doing that would be worth the perf.
Comment 4 Filip Pizlo 2017-08-12 11:40:24 PDT 
Landed in https://trac.webkit.org/changeset/220624/webkit
Comment 5 Radar WebKit Bug Importer 2017-08-12 11:41:02 PDT 
<rdar://problem/33864284>
Comment 6 Saam Barati 2017-08-12 12:07:13 PDT 
(In reply to Filip Pizlo from comment #3)
> (In reply to Saam Barati from comment #2)
> > Comment on attachment 317982 [details]
> > the patch
> > 
> > r=me
> > Does polymorphic access also access scoped arguments for “length”?
> 
> Yeah.  Since that's not an indexed access, we don't have to do caging there.
> We could do it, but then we'd be wagging the dog.
> 
> The objective here is to make indexed accesses never go outside of a cage.
> 
> Therefore, we but the object being accessed into a cage.
> 
> This does not mean that all non-indexed accesses to that object need caging.
> I don't think that the upside of doing that would be worth the perf.

Makes sense. We had this conversation before in a different context, I just forgot :)