Bug 101720 - If the DFG ArrayMode says that an access is on an OriginalArray, then the checks should always enforce this
Summary: If the DFG ArrayMode says that an access is on an OriginalArray, then the che...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Filip Pizlo
URL:
Keywords:
Depends on:
Blocks: 101718
  Show dependency tree / graph
 
Reported: 2012-11-09 00:25 PST by Filip Pizlo
Modified: 2012-11-09 21:54 PST (History)
7 users (show)

See Also:

Attachments
the patch (10.51 KB, patch)
2012-11-09 14:26 PST, Filip Pizlo 		mhahnenberg: review-
Details | Formatted Diff | Diff
the patch (19.92 KB, patch)
2012-11-09 17:36 PST, Filip Pizlo 		mhahnenberg: review+
Details | Formatted Diff | Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2012-11-09 00:25:00 PST 
This allows us to cheaply validate whether or not a JSArray still has sane prototype chain, even if we're not using a structure check.
Comment 1 Filip Pizlo 2012-11-09 14:26:13 PST 
Created attachment 173365 [details]
the patch
Comment 2 Mark Hahnenberg 2012-11-09 14:36:01 PST 
Comment on attachment 173365 [details]
the patch

r- after doing some rubber ducky. Gotta watch out for "primordial" array structures from other global objects.
Comment 3 Filip Pizlo 2012-11-09 14:51:38 PST 
(In reply to comment #2)
> (From update of attachment 173365 [details])
> r- after doing some rubber ducky. Gotta watch out for "primordial" array structures from other global objects.

Yeah. There's a much better way to do this.  Just go full retard with OriginalArray.
Comment 4 Filip Pizlo 2012-11-09 17:36:35 PST 
Created attachment 173414 [details]
the patch
Comment 5 Mark Hahnenberg 2012-11-09 18:01:37 PST 
Comment on attachment 173414 [details]
the patch

r=me
Comment 6 Filip Pizlo 2012-11-09 21:54:49 PST 
Landed in http://trac.webkit.org/changeset/134151