|Summary:||Clients of JSArray::tryCreateUninitializedRestricted() should invoke the mutatorFence().|
|Product:||WebKit||Reporter:||Mark Lam <mark.lam>|
|Severity:||Normal||CC:||fpizlo, keith_miller, msaboff, rmorisset, saam, tzagallo, webkit-bug-importer, ysuzuki|
|Version:||WebKit Nightly Build|
Description Mark Lam 2019-10-21 19:38:16 PDT
Comment 1 Radar WebKit Bug Importer 2019-10-21 19:38:56 PDT
Comment 2 Mark Lam 2019-10-21 19:40:40 PDT
Created attachment 381501 [details] work in progress for EWS testing.
Comment 3 Mark Lam 2019-10-21 23:37:51 PDT
Created attachment 381513 [details] proposed patch.
Comment 4 Saam Barati 2019-10-22 12:03:48 PDT
Comment 5 Mark Lam 2019-10-22 14:19:57 PDT
(In reply to Saam Barati from comment #4) > I think this is necessary because when we store the array into another > object. But I don't think it's necessary for this reason. Thanks for the review. I've fixed the comment. Landed in r251456: <http://trac.webkit.org/r251456>.