RESOLVED FIXED Bug 174923
ScopedArguments overflow storage needs to be in the JSValue gigacage 
https://bugs.webkit.org/show_bug.cgi?id=174923
Summary ScopedArguments overflow storage needs to be in the JSValue gigacage
Filip Pizlo
Reported 2017-07-27 19:46:22 PDT
...
Attachments
the patch (4.57 KB, patch)
2017-08-11 18:08 PDT, Filip Pizlo 		saam: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2017-08-11 18:08:35 PDT
Created attachment 317982 [details] the patch
Saam Barati
Comment 2 2017-08-12 11:13:21 PDT
Comment on attachment 317982 [details] the patch r=me Does polymorphic access also access scoped arguments for “length”?
Filip Pizlo
Comment 3 2017-08-12 11:39:28 PDT
(In reply to Saam Barati from comment #2) > Comment on attachment 317982 [details] > the patch > > r=me > Does polymorphic access also access scoped arguments for “length”? Yeah. Since that's not an indexed access, we don't have to do caging there. We could do it, but then we'd be wagging the dog. The objective here is to make indexed accesses never go outside of a cage. Therefore, we but the object being accessed into a cage. This does not mean that all non-indexed accesses to that object need caging. I don't think that the upside of doing that would be worth the perf.
Filip Pizlo
Comment 4 2017-08-12 11:40:24 PDT
Landed in https://trac.webkit.org/changeset/220624/webkit
Radar WebKit Bug Importer
Comment 5 2017-08-12 11:41:02 PDT
<rdar://problem/33864284>
Saam Barati
Comment 6 2017-08-12 12:07:13 PDT
(In reply to Filip Pizlo from comment #3) > (In reply to Saam Barati from comment #2) > > Comment on attachment 317982 [details] > > the patch > > > > r=me > > Does polymorphic access also access scoped arguments for “length”? > > Yeah. Since that's not an indexed access, we don't have to do caging there. > We could do it, but then we'd be wagging the dog. > > The objective here is to make indexed accesses never go outside of a cage. > > Therefore, we but the object being accessed into a cage. > > This does not mean that all non-indexed accesses to that object need caging. > I don't think that the upside of doing that would be worth the perf. Makes sense. We had this conversation before in a different context, I just forgot :)
Note You need to log in before you can comment on or make changes to this bug.