Bug 31198 – Can cache prototype lookups on uncacheable dictionaries.

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Oliver Hunt]

var o = {a:5,b:6}; var a={__proto__:o}; delete o.b; function f(o) {return o.a; }; f(a); f(a);f(a); delete o.a; o.c="FAIL"; alert(f(a));

[Oliver Hunt]

Created attachment 42816 [details]
Patch

[Gavin Barraclough]

Comment on attachment 42816 [details]
Patch

I don't like the name sortedProperties, partly because in the first loop, it isn't yet sorted, partly because it was not immediately clear to me these were pointers into the original map (modified by the entry-> writes).

I'm not sure what a good name would be, so I think a couple more comments (like, "These writes are modifying the persistent property map for the structure!".  Or something.)

And the variable name 'p' is kinda sucky, too.

But the code all looks sensible, r+.

[Oliver Hunt]

Committed r50704

[Shinichiro Hamaji]

Created attachment 42842 [details]
Fix wrong expectation

[Oliver Hunt]

Comment on attachment 42842 [details]
Fix wrong expectation

r=me

whoops :-(

[Oliver Hunt]

Comment on attachment 42842 [details]
Fix wrong expectation

I guess the commit bot won't land build fixes. weee!