Bug 157760 - TypeSet/StructureShape have a flawed sense of JS prototype chains
Summary: TypeSet/StructureShape have a flawed sense of JS prototype chains
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Saam Barati
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2016-05-16 15:29 PDT by Saam Barati
Modified: 2016-05-16 16:26 PDT (History)
12 users (show)

See Also:

Attachments
patch (2.82 KB, patch)
2016-05-16 15:34 PDT, Saam Barati 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Saam Barati 2016-05-16 15:29:28 PDT 
There was an assumption that we would bottom out in "Object". This is not true for many reasons.
Comment 1 Saam Barati 2016-05-16 15:34:31 PDT 
Created attachment 279054 [details]
patch
Comment 2 BJ Burg 2016-05-16 15:36:39 PDT 
rdar://problem/26288389
Comment 3 Joseph Pecoraro 2016-05-16 15:42:08 PDT 
Comment on attachment 279054 [details]
patch

r=me
Comment 4 WebKit Commit Bot 2016-05-16 16:26:31 PDT 
Comment on attachment 279054 [details]
patch

Clearing flags on attachment: 279054

Committed r200980: <http://trac.webkit.org/changeset/200980>
Comment 5 WebKit Commit Bot 2016-05-16 16:26:36 PDT 
All reviewed patches have been landed.  Closing bug.