Bug 31198

Summary: Can cache prototype lookups on uncacheable dictionaries.
Product: WebKit Reporter: Oliver Hunt <oliver>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Severity: Normal CC: barraclough, ggaren, oliver
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: OS X 10.5   
Description Flags
Fix wrong expectation oliver: review+

Description Oliver Hunt 2009-11-05 22:38:12 PST
var o = {a:5,b:6}; var a={__proto__:o}; delete o.b; function f(o) {return o.a; }; f(a); f(a);f(a); delete o.a; o.c="FAIL"; alert(f(a));
Comment 1 Oliver Hunt 2009-11-09 17:43:35 PST
Created attachment 42816 [details]
Comment 2 Gavin Barraclough 2009-11-09 18:07:43 PST
Comment on attachment 42816 [details]

I don't like the name sortedProperties, partly because in the first loop, it isn't yet sorted, partly because it was not immediately clear to me these were pointers into the original map (modified by the entry-> writes).

I'm not sure what a good name would be, so I think a couple more comments (like, "These writes are modifying the persistent property map for the structure!".  Or something.)

And the variable name 'p' is kinda sucky, too.

But the code all looks sensible, r+.
Comment 3 Oliver Hunt 2009-11-09 18:20:09 PST
Committed r50704
Comment 4 Shinichiro Hamaji 2009-11-09 19:25:14 PST
Created attachment 42842 [details]
Fix wrong expectation
Comment 5 Oliver Hunt 2009-11-09 19:26:30 PST
Comment on attachment 42842 [details]
Fix wrong expectation


whoops :-(
Comment 6 Oliver Hunt 2009-11-09 19:31:14 PST
Comment on attachment 42842 [details]
Fix wrong expectation

I guess the commit bot won't land build fixes. weee!